CVE-2019-20920
CVE-2019-20920
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
CVSS 8.1 · High · EPSS 3.2% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
node-handlebars Debian:12
- Affected ranges
- ECOSYSTEM: < 3:4.5.3-1
Update to 3:4.5.3-1
node-handlebars Debian:13
- Affected ranges
- ECOSYSTEM: < 3:4.5.3-1
Update to 3:4.5.3-1
node-handlebars Debian:14
- Affected ranges
- ECOSYSTEM: < 3:4.5.3-1
Update to 3:4.5.3-1
handlebars npm
- Affected ranges
- SEMVER: < 3.0.8
Update to 3.0.8
handlebars npm
- Affected ranges
- SEMVER: ≥ 4.0.0, < 4.5.3
Update to 4.5.3
node-handlebars Ubuntu:18.04:LTS
- Versions
- 3:4.0.10-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published