search

de7ign / flashcard

flashcard in react-native
MIT License
0 stars 0 forks source link

CVE-2019-19919 (High) detected in handlebars-4.1.2.tgz - autoclosed #10

Closed mend-bolt-for-github[bot] closed 2 years ago

mend-bolt-for-github[bot] commented 4 years ago

CVE-2019-19919 - High Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /flashcard/package.json

Path to vulnerable library: /tmp/git/flashcard/node_modules/handlebars/package.json

Dependency Hierarchy: - jest-24.8.0.tgz (Root Library) - jest-cli-24.8.0.tgz - core-24.8.0.tgz - reporters-24.8.0.tgz - istanbul-reports-2.2.6.tgz - :x: **handlebars-4.1.2.tgz** (Vulnerable Library)

Found in HEAD commit: 50880f29e55e386931266167e75af1875464df8c

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-12-20

Fix Resolution: 4.3.0

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.