Description
It is possible to inject and run code within the template if the attacker has access to write the template name.
Recommendation
Update the @blakeembrey/template package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.2.0
- Patched version(s): 1.2.0
References
Could your website be exposed too?
SmartScanner can check your website for @blakeembrey/template vulnerable to code injection when attacker controls template input and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin - CVE-2023-22621
- lodash vulnerable to Code Injection via `_.template` imports key names - CVE-2026-4800
- lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800
- lodash vulnerable to Code Injection via `_.template` imports key names - lodash-amd - CVE-2026-4800
You might also like:
See something that needs correcting? Let us knowUpdated November 18, 2024