CVE-2019-20920CWE-94code-injection

CVE-2019-20920

High · published September 30, 2020

CVSS v3.1
8.1
EPSS
3%
Percentile
88.0
In the wild
Unconfirmed
What it is

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.03193 · 88.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2020-09-30T22:15Z
Affected products (2)
ProductVersionsFixed in
handlebarsjs/handlebars< 3.0.83.0.8
handlebarsjs/handlebars≥ 4.0.0, < 4.5.34.5.3
References (6)
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478 · [email protected]https://www.npmjs.com/advisories/1316 · [email protected]https://www.npmjs.com/advisories/1324 · [email protected]https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478 · af854a3a-2127-422b-91ae-364da2661108https://www.npmjs.com/advisories/1316 · af854a3a-2127-422b-91ae-364da2661108https://www.npmjs.com/advisories/1324 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 30 SEP 12:30Z
    Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution
    cvelistv5