Description
Affected versions of jsrender are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.
Recommendation
Update the jsrender package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.9.73
- Patched version(s): 0.9.74
References
Could your website be exposed too?
SmartScanner can check your website for Template Injection in jsrender and gives you actionable findings to investigate.
Start a free scanRelated Issues
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-chat - CVE-2026-46580
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code - CVE-2026-46580
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion - CVE-2026-46580
- TypeORM: migration:generate template-literal code injection - CVE-2026-73651
You might also like:
See something that needs correcting? Let us knowUpdated September 07, 2023