EIQ-2019-0009

EIQ-2019-0009

-

Handlebars.js enables prototype pollution

15 Feb 2019

3 - HIGH

CVSSv3 score not available on NIST NVD.

2.3.4

The Handlebars.js Node.js module versions 4.0.12 and earlier make it possible for an attacker to modify the __proto__ accessor property.
Modified properties are propagated through inheritance to all objects.

This enables arbitrary adding or modifying object prototype properties, and arbitrary code execution on the targeted server.

Update to Handlebars.js 4.0.13 or later.

2.3.0 to 2.3.3 included.

For more information, see:

• npm advisory

• Prototype pollution affecting Handlebars.js package, versions < 4.0.13

• GitHub commit

• CWE-471