WS-2019-0103 (Medium) detected in handlebars-1.3.0.tgz - autoclosed

[mend-bolt-for-github[bot]]

WS-2019-0103 - Medium Severity Vulnerability

Vulnerable Library - handlebars-1.3.0.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-1.3.0.tgz

Path to dependency file: /ngx-image-dimension/package.json

Path to vulnerable library: ngx-image-dimension/node_modules/handlebars/package.json

Dependency Hierarchy: - cli-1.1.0.tgz (Root Library) - postcss-url-5.1.2.tgz - directory-encoder-0.7.2.tgz - :x: **handlebars-1.3.0.tgz** (Vulnerable Library)

Vulnerability Details

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Publish Date: 2019-01-30

URL: WS-2019-0103

CVSS 3 Score Details (5.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/wycats/handlebars.js/commit/edc6220d51139b32c28e51641fadad59a543ae57

Release Date: 2019-01-30

Fix Resolution: 4.1.0

---

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.