OpenAPITools / OpenAPITools/openapi-generator
Handlebars v4.3.1 affected by CVE-2025-48924 - request to upgrade to v4.5.0
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
Hello,
I noticed that the latest published version as well as the current pom.xml configuration still references Handlebars v4.3.1, which is affected by CVE-2025-48924.
Would it be possible to upgrade to Handlebars v4.5.0, along with handlebars-jackson
<dependency>
<groupId>com.github.jknack</groupId>
<artifactId>handlebars-jackson</artifactId>
<version>4.5.0</version>
</dependency>
instead of using handlebars-jackson2, to mitigate this vulnerability?
Thanks in advance for looking into this!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the repository's pom.xml and inspect the current Handlebars and handlebars-jackson2 dependencies. Verify the compatibility of Handlebars 4.5.0 with handlebars-jackson, update the dependency configuration, and run the relevant Maven build or tests to confirm the vulnerable 4.3.1 version is no longer used.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- handlebars, java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100