Prototype Pollution in handlebars

2019-12-2617:58:13

Google

osv.dev

0.009 Low

EPSS

Percentile

83.0%

JSON

Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects’ __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Recommendation

Upgrade to version 3.0.8, 4.3.0 or later.

CPENameOperatorVersion
bootstrap-wysihtml5-railseq0.3.3.8
handlebarslt4.3.0
handlebarsge4.0.0
bootstrap-wysihtml5-railseq0.3.3.7
bootstrap-wysihtml5-railseq0.3.3.5
handlebarslt3.0.8
bootstrap-wysihtml5-railseq0.3.3.6

Name	Operator	Version
bootstrap-wysihtml5-rails	eq	0.3.3.8
handlebars	lt	4.3.0
handlebars	ge	4.0.0
bootstrap-wysihtml5-rails	eq	0.3.3.7
bootstrap-wysihtml5-rails	eq	0.3.3.5
handlebars	lt	3.0.8
bootstrap-wysihtml5-rails	eq	0.3.3.6