Arbitrary Code Execution in handlebars

Versions of handlebars prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server...

Denial of Service in handlebars

Affected versions of handlebars are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. Recommendation Upgrade to version 4.4.5 or...

GHSA-F52G-6JHX-586P Denial of Service in handlebars

Affected versions of handlebars are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. Recommendation Upgrade to version 4.4.5 or...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1559 more potentially affected by unknown CVE via handlebars (>=4.0.0, <=4.4.3)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F52G-6JHX-586P...

PT-2020-21262

Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.4.5 Description The issue allows attackers to force the package's parser into an endless loop while processing specially-crafted templates, potentially exhausting system resources and leading to Denial of Service...

The vulnerability of the __proto__ and __defineGetter__ properties of the Handlebars template engine allows a attacker to execute arbitrary code.

The vulnerability of the proto and defineGetter properties of the Handlebars template engine exists because special elements are not properly eliminated. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2019-19919

A flaw was found in nodejs-handlebars, where it is vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which allows an attacker to execute arbitrary code through crafted payloads. The highest threat from this...

@behance/istanbul (0.3.17-sourcemap), @bigcommerce/stencil-paper (>=2.0.15, <=2.0.25) +220 more potentially affected by CVE-2019-19919 via handlebars (>=3.0.0, <=3.0.7)

handlebars NPM version =3.0.0, =2.0.15, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 and more Source cves: CVE-2019-19919 Source advisory: OSV:GHSA-W457-6Q6X-CGP9...

Prototype Pollution in handlebars

Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads. Recommendation Upgrade to versi...

GHSA-W457-6Q6X-CGP9 Prototype Pollution in handlebars

Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads. Recommendation Upgrade to versi...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1476 more potentially affected by CVE-2019-19919 via handlebars (>=4.0.0, <=4.2.2)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =6.0.10 and more Source cves: CVE-2019-19919 Source advisory: OSV:GHSA-W457-6Q6X-CGP9...

Prototype Pollution in handlebars

The bootstrap-wysihtml5-rails gem includes the vendored JavaScript library 'handlebars.js'. Versions 0.3.3.7-0.3.3.8 include handlebars 3.0.2, and versions 0.3.3.5-0.3.3.6 include handlebars 1.3.0. Versions Affected: 0.3.3.5-0.3.3.8 Not affected: 0.3.3.5 Fixed Versions: None Versions of handlebar...

Unspecified vulnerability in handlebars

handlebars is a semantic Web template system. A security vulnerability exists in handlebars versions prior to 4.3.0. The vulnerability can be exploited by an attacker to execute arbitrary code with the help of specially crafted payloads...

CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

DEBIAN-CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

UBUNTU-CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

Remote code execution

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...