Cross site scripting

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...

CVE-2019-20920

A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to arbitrary code execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript into the system. This issue is used to...

CVE-2019-20922

A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to a denial of service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This flaw allows attackers to exhaust system resources, leading to a denial of...

CVE-2019-20920

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...

101 (>=0.3.0, <=0.7.1), 3c (>=0.0.1-alpha, <=1.0.0) +3339 more potentially affected by CVE-2019-20920 via handlebars (>=1.0.6-2, <=3.0.7)

handlebars NPM version =1.0.6-2, =0.3.0, =0.0.1-alpha, =0.0.1, =1.0.0-beta.33, =1.0.1, =1.0.0, =1.31.0-SNAPSHOT, =0.1.16-master.20181116180810, =0.9.33, =0.9.33, =5.0.2, =5.0.3, =5.0.6, =5.0.7 and more Source cves: CVE-2019-20920 Source advisory: MEND:CVE-2019-20920...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1579 more potentially affected by CVE-2019-20920 via handlebars (>=4.0.0, <=4.5.2)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: CVE-2019-20920 Source advisory: MEND:CVE-2019-20920...

CVE-2019-20920

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...

CVE-2019-20920

Technical details about CVE-2019-20920 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2019-20920

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

CVE-2019-20922

CVE-2019-20922 affects the Handlebars.js template engine before 4.4.5. The vulnerability stems from an eager RegExp matching approach in the parser, which can be forced into an endless loop by crafted templates, leading to resource exhaustion. Impact is described as denial of service via consumed...

CVE-2019-20922

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1559 more potentially affected by CVE-2019-20922 via handlebars (>=4.0.0, <=4.4.3)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: CVE-2019-20922 Source advisory: MEND:CVE-2019-20922...

PT-2020-10875

Name of the Vulnerable Software and Affected Versions Handlebars versions prior to 3.0.8 Handlebars versions 4.x prior to 4.5.3 Description The issue allows attackers to execute arbitrary JavaScript code by submitting templates that are not properly validated by the lookup helper. This can lead t...

CVE-2019-20920: Improper Control of Generation of Code

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...

PT-2020-10877

Name of the Vulnerable Software and Affected Versions Handlebars versions prior to 4.4.5 Description The issue allows for Regular Expression Denial of Service ReDoS due to eager matching, which can cause the parser to enter an endless loop when processing crafted templates. This may enable...

CVE-2019-20922: Uncontrolled Resource Consumption

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

@behance/istanbul (0.3.17-sourcemap), @bigcommerce/stencil-paper (>=2.0.15, <=2.0.25) +220 more potentially affected by unknown CVE via handlebars (>=3.0.0, <=3.0.7)

handlebars NPM version =3.0.0, =2.0.15, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q2C6-C6PM-G3GH...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1579 more potentially affected by unknown CVE via handlebars (>=4.0.0, <=4.5.2)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q2C6-C6PM-G3GH...