mustache-js-rails 0.0.5
1 security vulnerability
found in version
0.0.5
mustache.js - quoteless attributes in templates can lead to XSS
high severity OSVDB-131671
high severity
OSVDB-131671
Patched versions:
>= 2.0.3
The upstream 'mustache.js' node.js module was found to not properly escape backtick (`) and equals (=) characters, leading to possible content injection via attributes in templates.
Example:
- Template:
- Input: { 'foo' : 'test.com onload=alert(1)'}
- Rendered result:
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
Gem version without a license.
Unless a license that specifies otherwise is included, nobody can use, copy, distribute, or modify this library without being at risk of take-downs, shake-downs, or litigation.
This gem version is available.
This gem version has not been yanked and is still available for usage.