CVE-2019-20920
ADVISORY - githubSummary
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Common Weakness Enumeration (CWE)
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection')
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
Improper Control of Generation of Code ('Code Injection')
Improper Input Validation
Sign in to Docker Scout
See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.
Sign in