GHSA-Q42P-PG8M-CQH6 Prototype Pollution in handlebars

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or late...

@behance/istanbul (0.3.17-sourcemap), @cmss/jslib (>=0.4.0, <=0.6.0) +219 more potentially affected by unknown CVE via handlebars (>=3.0.0, <=3.0.3)

handlebars NPM version =3.0.0, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 - arescli 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1075 more potentially affected by unknown CVE via handlebars (>=4.0.0, <=4.0.13)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =0.1.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...

@abeai/node-sdk (>=6.2.1-rc1, <=7.3.1), @after-work.js/aw (>=6.0.0-dev.20190228.0, <=6.0.5) +62 more potentially affected by unknown CVE via handlebars (>=4.1.0, <=4.1.1)

handlebars NPM version =4.1.0, =6.2.1-rc1, =6.0.0-dev.20190228.0, =6.0.0-dev.20190228.0, =0.0.41, =0.9.9, =0.4.0, =1.0.4, =0.2.6, =1.2.0-17d3c29f-b3, =1.0.0-beta.2, =3.9.4, =1.5.3, =7.0.0, =7.0.21 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...

@abeai/node-sdk (>=6.2.1-rc1, <=7.3.1), @after-work.js/aw (>=6.0.0-dev.20190228.0, <=6.0.5) +62 more potentially affected by unknown CVE via handlebars (>=4.1.0, <=4.1.1)

handlebars NPM version =4.1.0, =6.2.1-rc1, =6.0.0-dev.20190228.0, =6.0.0-dev.20190228.0, =0.0.41, =0.9.9, =0.4.0, =1.0.4, =0.2.6, =1.2.0-17d3c29f-b3, =1.0.0-beta.2, =3.9.4, =1.5.3, =7.0.0, =7.0.21 and more Source cves: unknown CVE Source advisory: GHSA-Q42P-PG8M-CQH6...

@behance/istanbul (0.3.17-sourcemap), @cmss/jslib (>=0.4.0, <=0.6.0) +219 more potentially affected by unknown CVE via handlebars (>=3.0.0, <=3.0.3)

handlebars NPM version =3.0.0, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 - arescli 0.1.0 and more Source cves: unknown CVE Source advisory: GHSA-Q42P-PG8M-CQH6...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1075 more potentially affected by unknown CVE via handlebars (>=4.0.0, <=4.0.13)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =0.1.0, =0.4.1 and more Source cves: unknown CVE Source advisory: GHSA-Q42P-PG8M-CQH6...

Prototype Pollution in handlebars

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or late...

Fedora 30 : nodejs-handlebars (2019-c1213f866c)

Security fix for https://www.npmjs.com/advisories/755 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Remote Code Execution

handlebars is vulnerable to remote code execution. The vulnerability exists because it is possible to manipulate the template and access the constructor in the template, allowing an attacker to inject arbitrary code through it...

Remote Code Execution (RCE)

handlebars is vulnerable to remote code execution. Access to the constructor in templates is not prohibited, allowing an attacker to inject arbitrary templates into the Handlebars setup and execute arbitrary code...

Prototype Pollution

Overview Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.1...

GHSA-9PRH-257W-9277 Cross-Site Scripting in handlebars

Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted. Proof of Concept Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 4.0.0 or later. Alternatively,...

Cross-Site Scripting in handlebars

Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted. Proof of Concept Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 4.0.0 or later. Alternatively,...

Cross site scripting

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

CVE-2014-0013

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

CVE-2014-0013

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

CVE-2014-0013

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

PT-2018-4116

Name of the Vulnerable Software and Affected Versions Ember.js versions 1.0.x through 1.0.0, 1.1.x through 1.1.2, 1.2.x through 1.2.0, 1.3.x through 1.3.0, and 1.4.x through 1.4.0-beta.1 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an...

CVE-2014-0013: Improper Neutralization of Input During Web Page Generation

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...