CVE-2024-45390

Description

### Impact It is possible to inject and run code within the template if the attacker has access to write the template name. ```js const { template } = require('@blakeembrey/template'); template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned"); ``` ### Patches Upgrade to 1.2.0. ### Workarounds Don't pass untrusted input as the template display name, or don't use the display name feature. ### References Fixed by removing in https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa.

How to fix CVE-2024-45390

To remediate CVE-2024-45390, upgrade the affected package to a fixed version below.

• —upgrade to 1.2.0 or later

Is CVE-2024-45390 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.2.0

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-45390
• PATCHgithub.com/blakeembrey/js-template
• WEBgithub.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa
• WEBgithub.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qj