CGA-24pm-f3rp-x72m

Published

Last updated

https://images.chainguard.dev/security/CGA-24pm-f3rp-x72m

Package

gitlab-rails-ee-17.0

Latest Update

Not affected

Aliases

CVE-2019-20920
GHSA-3cqr-58rm-57f8

Severity

8.1

High

CVSS V3

Summary

Arbitrary Code Execution in Handlebars

Description

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

References

https://nvd.nist.gov/vuln/detail/CVE-2019-20920
https://github.com/advisories/GHSA-3cqr-58rm-57f8
https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee
https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478
https://www.npmjs.com/advisories/1316
https://www.npmjs.com/advisories/1324
https://www.npmjs.com/package/handlebars

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CGA-24pm-f3rp-x72m

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources