CVE-2024-45390

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
blakeembrey	js-template	< 1.2.0
blakeembrey	js-template	< 1.2.0

References

Timeline

Published: Sep 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-453917.5Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 t CVE-2024-453924.3SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control che CVE-2024-453936.4Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT accoun CVE-2024-453947.8Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data CVE-2024-453957.5sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 whe CVE-2024-453967.5Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker CVE-2024-453977.5h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or CVE-2024-453988.8Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute th CVE-2024-453996.1Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version CVE-2024-45407.5A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain CVE-2024-454006.1ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link CVE-2024-454017.1stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prio