p PatchFirst

CVE-2015-8861

CVE-2015-8861

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

CVSS 6.1 · Medium · EPSS 2.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mustache.js Debian:12

    Versions
    • 3.0.1-1
    • 3.0.1-2
    • 3.2.0-1
    • 3.2.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mustache.js Debian:13

    Versions
    • 3.0.1-1
    • 3.0.1-2
    • 3.2.0-1
    • 3.2.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mustache.js Debian:14

    Versions
    • 3.0.1-1
    • 3.0.1-2
    • 3.2.0-1
    • 3.2.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • handlebars npm

    Affected ranges
    • SEMVER: < 4.0.0

    Update to 4.0.0

Original sources

Check your server →