Componentpedia: handlebars : 1.2.1 issues and vulnerabilities | Meterian Boost Open Source Security Resource

Threat level: MEDIUM | CVSS score: 5

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

CVE-2015-8861
CWE-79
Threat level: MEDIUM | CVSS score: 6.1

The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

CVE-2021-23369
Threat level: CRITICAL | CVSS score: 9.8

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2021-23383
CWE-1321
Threat level: CRITICAL | CVSS score: 9.8

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2019-20920
CWE-94
Threat level: HIGH | CVSS score: 8.1

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Componentpedia / Listings / handlebars / 1.2.1

handlebars