CVE-2019-20920

Description

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

References

https://www.npmjs.com/advisories/1324

https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3