Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2019-20920
8.1
HIGHCVSS v3
Published
September 30, 2020
CVSS v2
6.8 MEDIUM
Affected
4 projects
Assigned by
MITRE
Severity scale
010
Description
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
handlebars
NPMHandlebars provides the power necessary to let you build semantic templates effectively with no frustration
NPMHandlebars provides the power necessary to let you build semantic templates effectively with no frustration>= 4.0.0, < 4.5.3, < 3.0.8NVD
@types/handlebarsNPMStub TypeScript definitions entry for handlebars, which provides its own types definitions
NPMStub TypeScript definitions entry for handlebars, which provides its own types definitions>= 4.0.0, < 4.5.3, < 3.0.8NVD
Crates.io
RubyGems