CVE-2024-45390
@blakeembrey/template vulnerable to code injection when attacker controls template input
Résumé
@blakeembrey/template vulnerable to code injection when attacker controls template input
Description d'origine
La description telle que publiée par la source (souvent en anglais).
@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com