You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.
Vulnerable Library - handlebars-4.1.2.min.js
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.1.2/handlebars.min.js
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2019-19919
Vulnerable Library - handlebars-4.1.2.min.js
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.1.2/handlebars.min.js
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Dependency Hierarchy:
Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f
Found in base branch: master
Vulnerability Details
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Publish Date: 2019-12-20
URL: CVE-2019-19919
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1164
Release Date: 2019-12-20
Fix Resolution: 4.3.0
WS-2019-0332
Vulnerable Library - handlebars-4.1.2.min.js
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.1.2/handlebars.min.js
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Dependency Hierarchy:
Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f
Found in base branch: master
Vulnerability Details
Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.
Publish Date: 2019-11-17
URL: WS-2019-0332
CVSS 2 Score Details (5.0)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-11-17
Fix Resolution: handlebars - 4.5.3
WS-2019-0331
Vulnerable Library - handlebars-4.1.2.min.js
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/4.1.2/handlebars.min.js
Path to dependency file: /examples/form_l10n/forms/myOtherForm/index.html
Path to vulnerable library: /examples/form_l10n/forms/myOtherForm/index.html,/examples/custom_form/forms/myForm/index.html,/examples/forms_wizard/forms/userData/index.html,/examples/dynamic_form_values/forms/myForm/index.html,/examples/forms_wizard/forms/userWarning/index.html
Dependency Hierarchy:
Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f
Found in base branch: master
Vulnerability Details
Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-13
URL: WS-2019-0331
CVSS 2 Score Details (5.0)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-11-13
Fix Resolution: handlebars - 4.5.2
The text was updated successfully, but these errors were encountered: