426 matches found
CVE-2026-55847
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...
CVE-2026-55847 Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...
EUVD-2026-77688
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the ansi.js helper at allure-generator/src/main/javascript/helpers/ansi.js passes attacker-influenced statusMessage and statusTrace values through AnsiToHtml without HTML escaping and wraps...
CVE-2026-55847
Allure 2 (a multi-language test reporting tool) is vulnerable to stored XSS in the ansi.js Handlebars helper within allure-generator. Prior to 2.39.0 , attacker-controlled statusMessage and statusTrace values (sourced from JUnit XML, TRX, xUnit, xctest, or Allure1/2 plugins) are passed through th...
CVE-2021-23369
CVE-2021-23369 Handlebars CVE-2021-23369 の脆弱性 pip install requests URL を入力してください : 脆弱性の説明 handlebars パッケージの 4.7.7 より前のバージョンは、信頼できないソースからのテンプレートをコンパイルするために特定のコンパイルオプションを選択した場合、リモートコード実行 RCE に対して脆弱です。...
Check-CVE-2021-23383
Check-CVE-2021-23383 handlebars ライブラリのバージョン評価を通じて、CVE-2021-23383 を悪用するための条件を確認します。...
CVE-2021-23383
CVE-2021-23383 パッケージ handlebars のバージョン 4.7.7 未満は、信頼できないソースからのテンプレートをコンパイルする際に特定のコンパイルオプションを選択すると、Prototype Pollution に対して脆弱です。...
CVE-2019-19919
CVE-2019-19919 Handlebars の下流コンポーネントが使用する出力内の特殊要素の不適切な無害化（'インジェクション'）の脆弱性 pip install requests packaging python handlebarsscanner.py pip install requests python handlebarsexploit.py ターゲット URL を入力: エクスプロイトの期待される出力: ターゲット URL を入力（例: http://example.com/render）: http://example.com/render 実行する OS...
Express-handlebars - Local File Inclusion
Express-handlebars is susceptible to local file inclusion because it mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2026-33937-for-DarkZeroReturns
CVE-2026-33937 的 POC 这是针对 CVE-2026-33937 的 PoC，由 AI 制作，旨在利用 DarkZeroRetuns 靶机中的 Handelbars 漏洞。 原始 PoC 位于 https://github.com/EQSTLab/CVE-2026-33937/blob/main/exploit.py，但它不适用于这个特定的靶机。 该 PoC 由 Chatgpt Sol 5.6 编写。...
CVE-2026-87123
hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...
cve-2026-33937
CVE-2026-33937 - Handlebars RCE 漏洞利用 PoC 描述 CVE-2026-33937 是 Handlebars 中的一个严重远程代码执行（RCE）漏洞，由对抽象语法树（AST）输入的不安全处理引起。 该漏洞允许攻击者通过向 Handlebars.compile 提供精心构造的 AST 对象来注入任意 JavaScript 代码。 根本原因 Handlebars.compile 接受两种输入： 模板字符串 预解析的 AST 对象 当提供 AST 对象时，解析阶段会被跳过。 在： root@kitploit:...
CVE-2026-29053
Este es un rediseño del Repo de rootxran para este mismo CVE - https://github.com/rootxran/CVE-2026-29053 Durante las pruebas contra entornos específicos de Ghost CMS, el payload del tema original provocó un Error Fatal de Handlebars. El CMS no pudo activar el tema malicioso porque hacía referenc...
CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...
CVE-2026-16231
hbs , an Express view engine wrapping Handlebars, has a cross-site scripting vulnerability in its registerAsyncHelper API. An async helper returns an opaque placeholder during the first render pass, so Handlebars' double-brace escaping applies only to the placeholder. After rendering, hbs substit...
CLSA-2026-1787070403 TuxCare security update for handlebars (2 CVEs)
TuxCare rebuilt handlebars to address 2 CVEs. Fixed in 2.0.0-tuxcare.5...
EUVD-2026-53371
The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its templateString property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input. Because...
CLSA-2026-1785117463 TuxCare security update for handlebars (5 CVEs)
TuxCare rebuilt handlebars to address 5 CVEs. Fixed in 3.0.8-tuxcare.3...