CVE-2024-45390

描述

### Impact It is possible to inject and run code within the template if the attacker has access to write the template name. ```js const { template } = require('@blakeembrey/template'); template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned"); ``` ### Patches Upgrade to 1.2.0. ### Workarounds Don't pass untrusted input as the template display name, or don't use the display name feature. ### References Fixed by removing in https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa.

如何修補 CVE-2024-45390

要修補 CVE-2024-45390,請將受影響套件升級到下列已修補版本。

• —升級至 1.2.0 或更新版本

CVE-2024-45390 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.2.0

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-45390
• PATCHgithub.com/blakeembrey/js-template
• WEBgithub.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa
• WEBgithub.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qj