Description
Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.
Recommendation
Update the handlebars package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.5.3 < 3.0.8** Patched version(s): **4.5.3 3.0.8**
References
Related Issues
- Prototype Pollution in handlebars - handlebars - GHSA-q42p-pg8m-cqh6 - Vulnerability
- @thi.ng/paths Prototype Pollution vulnerability - CVE-2024-29650
- vue-i18n has cross-site scripting vulnerability with prototype pollution - CVE-2024-52809
- @intlify/shared Prototype Pollution vulnerability - @intlify/shared - CVE-2024-52810
You might also like:
- Tags:
- npm
- handlebars
Anything's wrong? Let us know Last updated on January 09, 2023