Description

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Remediation

References

CVE-2019-20920

Related Vulnerabilities

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Cross-Site Scripting (1.13.56)

WordPress Plugin VK All in One Expansion Unit Cross-Site Scripting (9.85.0.1)

Magento CVE-2019-7895 Vulnerability (CVE-2019-7895)

Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-8109)

WordPress Plugin mTouch Quiz Multiple Vulnerabilities (3.0.6)

Severity

High

Classification

CVE-2019-20920 CWE-94 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Tags

Missing Update Known Vulnerabilities