Prototype Pollution in handlebars

Description

Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects’ __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): **< 3.0.8

  >= 4.0.0, < 4.3.0**

• Patched version(s): **3.0.8

  4.3.0**

References

• GHSA-w457-6q6x-cgp9
• cve.mitre.org
• www.tenable.com
• CVE-2019-19919
• CWE-1321
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in handlebars - handlebars - CVE-2021-23383
• Prototype Pollution in dot-object - CVE-2019-10793
• Prototype Pollution in undefsafe - CVE-2019-10795
• Prototype Pollution in chartkick - CVE-2019-18841

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

handlebars