Snyk Security Database

handlebars is an extension to the Mustache templating language.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the quotedString() function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that Handlebars.precompile() generates without neutralizing a </script> sequence. An attacker can execute script in the browser under the embedding page's origin by placing </script> followed by markup in a template, which closes the script element early so the remainder is parsed as HTML. This requires the application to precompile templates the attacker controls and to embed the generated source directly in an inline <script> element, and the injected markup runs only when a user loads that page.

lore-cs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Affected versions of this package are vulnerable to Infinite loop in JSONReader.string() and JSONReader.skipWhiteSpace() in com.rabbitmq.tools.json, neither of which treats CharacterIterator.DONE as a terminator, so the string scanner appends that sentinel without bound and the line comment scanner spins in place. A user able to publish to the RPC request queue can exhaust the heap or pin a thread at full CPU indefinitely, by sending one JSON-RPC message that ends inside a string or a // comment. This requires the application to use the JSON-RPC over AMQP tooling in com.rabbitmq.tools.jsonrpc with the default DefaultJsonRpcMapper, and the condition is not confined to servers, since a client parsing a response from a JSON-RPC service fails the same way.