Currently, we are using ServiceStack 6.9, which internally uses Handlebars 4.7.7.min.js, which has a known vulnerability.
looks like it is fixed in 4.7.10. Could you please confirm which version of the service stack uses the fixed handlebars.js so that we can plan for an upgrade?
ServiceStack doesn’t use handlebars itself, the only place it’s included is in the embedded 3rd Party legacy v2 swagger-ui which hosts the old v2 of Swagger. For newer projects using Endpoint Routing we recommend upgrading to use the newer OpenAPI v3 options instead.
Given swagger-ui has abandoned v2 swagger-ui several years ago and there’s no maintained or update of swagger-ui with an upgraded handlebars.
But I’ve just manually upgraded our own interned copy of swagger-ui to use the latest handlebars-4.7.10.min.js dependency in this commit.
You will need to upgrade all your ServiceStack package deps to use 10.* to use it, e.g:
<PackageReference Include="ServiceStack" Version="10.*" />
v10 still includes support for:
This is available from ServiceStack v10.4.3+ that’s now available in the latest pre-release packages, that will be available future NuGet releases.