@blakeembrey/template vulnerable to code injection when attacker controls template input
- Severity:
- Medium
Description
It is possible to inject and run code within the template if the attacker has access to write the template name.
Recommendation
Update the @blakeembrey/template package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.2.0
- Patched version(s): 1.2.0
References
Related Issues
- Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin - CVE-2023-22621
- lodash vulnerable to Code Injection via `_.template` imports key names - CVE-2026-4800
- lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800
- lodash vulnerable to Code Injection via `_.template` imports key names - lodash-amd - CVE-2026-4800
You might also like:
- Tags:
- npm
- @blakeembrey/template
Anything's wrong? Let us know Last updated on November 18, 2024