Description
Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.
Remediation
References
https://github.com/PebbleTemplates/pebble/issues/493
Related Vulnerabilities
CVE-2018-3737 Vulnerability in npm package sshpk
CVE-2022-40151 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2023-26117 Vulnerability in npm package angular
CVE-2021-26707 Vulnerability in npm package merge-deep
CVE-2021-32824 Vulnerability in maven package org.apache.dubbo:dubbo-common