Fix CVE–2021–23383

[debricked-staging]

CVE–2021–23383

Vulnerable dependency:     handlebars (Yarn)    4.0.11

Vulnerable dependency:     handlebars (npm)    4.0.11

Vulnerability details

Description

NVD

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

GitHub

Prototype Pollution in handlebars

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    NVD - CVE-2021-23383
    fix: escape property names in compat mode (#1736) · handlebars-lang/handlebars.js@f058970 · GitHub
    CVE-2021-23383 Node.js Vulnerability in NetApp Products | NetApp Product Security
    Prototype Pollution in handlebars · CVE-2021-23383 · GitHub Advisory Database · GitHub
    handlebars - npm

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE