Search for packages
| purl | pkg:npm/handlebars@4.4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-q9rt-jtx1-hybx
Aliases: GHSA-q2c6-c6pm-g3gh GMS-2020-730 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in handlebars. |
Affected by 1 other vulnerability. |
|
VCID-s9ab-ntdt-vkgd
Aliases: GHSA-g9r4-xpmj-mj65 GMS-2020-729 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in handlebars. |
Affected by 1 other vulnerability. |
|
VCID-uv5v-22z9-fbfg
Aliases: GHSA-2cf5-4w76-r9qv GMS-2020-727 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in handlebars. |
Affected by 3 other vulnerabilities. |
|
VCID-xxez-8xav-cfdz
Aliases: CVE-2021-23369 GHSA-f2jv-r9rf-7988 |
Remote code execution in handlebars when compiling templates The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source. This vulnerability has been assigned the CVE identifier CVE-2021-23369. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-25sr-kapq-dbea | Denial of Service in handlebars Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. ## Recommendation Upgrade to version 4.4.5 or later. |
GHSA-f52g-6jhx-586p
GMS-2020-728 |
| VCID-cfg5-1ju5-73b1 | Uncontrolled Resource Consumption Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources. |
CVE-2019-20922
GHSA-62gr-4qp9-h98f |