Prototype Pollution in handlebars - handlebars

Description

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.7.7
• Patched version(s): 4.7.7

References

• GHSA-765h-qjxv-5f44
• snyk.io
• www.npmjs.com
• security.netapp.com
• CVE-2021-23383
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in dotty - dotty - CVE-2021-23624
• Prototype pollution in 101 - CVE-2021-25943
• Prototype Pollution in immer - immer - GHSA-c36v-fmgq-m8hx - CVE-2021-3757
• Prototype Pollution in Proto - CVE-2021-23426

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

handlebars