CVE-2024-45390
@blakeembrey/template vulnerable to code injection when attacker controls template input
概要
@blakeembrey/template vulnerable to code injection when attacker controls template input
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com