CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-45390?
CVE-2024-45390 is a high-severity vulnerability in blakeembrey js-template, published on 3 Sep 2024.
Official description
@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.
Weakness: CWE-94
Which versions are affected by CVE-2024-45390?
2 open source packages ship an affected version, including @blakeembrey/template. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@blakeembrey/template npm | All versions | 1.2.0 |
@blakeembrey/template npm | All versions | 1.2.0 |
Products include Blakeembrey Template.
How do I fix CVE-2024-45390?
Upgrade @blakeembrey/template to 1.2.0 or later.
Is CVE-2024-45390 being exploited?
There is no known exploitation of CVE-2024-45390 in the wild and no public exploit code.
Sources
Also known as GHSA-q765-wm9j-66qj.