High severity7.3NVD Advisory· Published Sep 3, 2024· Updated Jun 17, 2026

CVE-2024-45390

Description

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or don't use the display name feature.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@blakeembrey/templatenpm	< 1.2.0	1.2.0

Affected products

ghsa-coords
pkg:npm/%40blakeembrey/template
Range: < 1.2.0
Blakeembrey/Template2 versions
cpe:2.3:a:blakeembrey:template:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:blakeembrey:template:*:*:*:*:*:node.js:*:*range: <1.2.0
- (no CPE)range: < 1.2.0

Patches

Vulnerability mechanics

References

github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aanvdPatchWEB
github.com/advisories/GHSA-q765-wm9j-66qjghsaADVISORY
github.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qjnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-45390ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000