Description

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Remediation

References

https://www.npmjs.com/advisories/1164

https://www.tenable.com/security/tns-2021-14

Related Vulnerabilities

CVE-2020-6422 Vulnerability in npm package electron

CVE-2014-9970 Vulnerability in maven package org.jasypt:jasypt

CVE-2019-20921 Vulnerability in maven package org.webjars.bowergithub.snapappointments:bootstrap-select

CVE-2022-24999 Vulnerability in maven package org.webjars.bower:qs

CVE-2020-28426 Vulnerability in npm package kill-process-on-port

Severity

Critical

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory Patch