Description
Affected versions of jsrender are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.
Recommendation
Update the jsrender package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.9.73
- Patched version(s): 0.9.74
References
Related Issues
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-chat - CVE-2026-46580
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code - CVE-2026-46580
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion - CVE-2026-46580
- TypeORM: migration:generate template-literal code injection - CVE-2026-73651
You might also like:
- Tags:
- npm
- jsrender
Anything's wrong? Let us know Last updated on September 07, 2023