Prototype Pollution in handlebars - handlebars - GHSA-q42p-pg8m-cqh6

Description

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects’ prototype, thus allowing an attacker to execute arbitrary code on the server.

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): **< 3.0.7

  >= 4.0.0, < 4.0.14

  >= 4.1.0, < 4.1.2**

• Patched version(s): **3.0.7

  4.0.14

  4.1.2**

References

• GHSA-q42p-pg8m-cqh6
• snyk.io
• www.npmjs.com
• CWE-471
• OWASP 2021-A3

Related Issues

• Prototype Pollution in handlebars - handlebars - GHSA-g9r4-xpmj-mj65 - Vulnerability
• @intlify/shared Prototype Pollution vulnerability - @intlify/shared - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability - @intlify/vue-i18n-core - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability - vue-i18n - CVE-2024-52810

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

handlebars