CVE-2024-45390

Katalog CVE

CVSS 9.8 · Critical EPSS 0,43%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada blakeembrey template. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.

Rincian

Terbit di NVD

3 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qj advisory vendor
• https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa patch