Gyde04

**Name of the Vulnerable Software and Affected Versions** tmp (affected versions not specified) **Description** The `tmp` npm package contains a path traversal issue that allows escaping the intended temporary directory when untrusted data is passed into the `prefix`, `postfix`, or `dir` options. By embedding traversal sequences such as `../` or path separators, attackers can cause files to be created at attacker-controlled locations with the privileges of the running process. This occurs because the package directly concatenates user-supplied options into file paths without proper sanitization or validation, relying on `path.join()` which normalizes traversal sequences. The issue affects the `tmp.file()`, `tmp.dir()`, and `tmp.tmpName()` functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the `prefix` and `postfix` parameters by removing path separators and traversal sequences, and validate that the `dir` parameter is not an absolute path and does not escape the base directory. Avoid passing user-controlled data to the `tmp.file()`, `tmp.dir()`, and `tmp.tmpName()` functions.

**Name of the Vulnerable Software and Affected Versions** Handlebars versions 4.0.0 through 4.7.8 **Description** The Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings – template file names and several CLI options – directly into the JavaScript it emits without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. The issue stems from the interpolation of user-supplied data into JavaScript code without proper sanitization. Four injection points exist: template name, namespace (`-n` / `--namespace`), CommonJS path (`-c` / `--commonjs`), and AMD path (`-h` / `--handlebarPath`). Exploitation can lead to arbitrary code execution. Proof-of-concept exploits demonstrate the ability to create files on disk by injecting code through these vectors. **Recommendations** Versions prior to 4.7.9 are affected. Validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (`"`, `'`, `;`, etc.). Use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines. Run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation. Audit template filenames in any repository or package that is consumed by an automated build pipeline.