Description (CNA)
The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| miguelcobain / ember-dynamic-render-template | affected 0 through 0.0.6 |
CWE
CWE-1336
References
- https://github.com/miguelcobain/ember-dynamic-render-template
- https://github.com/miguelcobain/ember-dynamic-render-template/blob/master/addon/components/render-template.js
ADP enrichment
No English description supplied.
No references supplied.