VulnerabilityAnalyzed
CVE-2024-45390
Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name.
CRITICAL 9.8EPSS 0.43%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.43% probability · 37th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- blakeembrey/template
- Source
- security-advisories@github.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.