high7.3
CVE-2024-45390
@blakeembrey/template vulnerable to code injection when attacker controls template input
Impact
### Impact It is possible to inject and run code within the template if the attacker has access to write the template name. ```js const { template } = require('@blakeembrey/template'); template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned"); ``` ### Patches Upgrade to 1.2.0. ### Workarounds Don't pass untrusted input as the template display name, or don't use the display name feature. ### References Fixed by removing in https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @blakeembrey/template | < 1.2.0 | 1.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Blakeembrey | Template | before 1.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa
- https://github.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qj
- https://github.com/advisories/GHSA-q765-wm9j-66qj
- https://nvd.nist.gov/vuln/detail/CVE-2024-45390