# CVE-2015-8861: Handlebars.js XSS in unquoted template attributes

Source: https://junglewise.ai/threats/cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2015-8861 · Severity: medium · CVSS 6.1 · Published 2017-01-23

Handlebars, a popular template engine for Node.js, is vulnerable to cross-site scripting (XSS). This occurs when templates use HTML attributes that are not enclosed in quotes, allowing an attacker to inject malicious scripts. If exploited, this could allow an attacker to steal user session data or perform unauthorized actions on behalf of users viewing the affected web pages.

Technologies: [Handlebars project Handlebars](https://junglewise.ai/threats/technologies/handlebars), [Handlebars.Js Project Handlebars.Js](https://junglewise.ai/threats/technologies/handlebars-js), [handlebars (npm)](https://junglewise.ai/threats/technologies/npm-handlebars). Vendors: [Handlebars project](https://junglewise.ai/threats/vendors/handlebars-project), [Handlebars.Js Project](https://junglewise.ai/threats/vendors/handlebars-js-project), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-8861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-8861 being exploited in the wild.

**How severe is CVE-2015-8861?** Medium severity, with a CVSS score of 6.1, published 23 January 2017.

**Which products and versions are affected?** Handlebars project Handlebars < 4.0.0; handlebars (npm) SEMVER:introduced=0,fixed=4.0.0.

**Is there a fix for CVE-2015-8861?** Yes. handlebars (npm): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-8861 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-8861?** Check whether you run Handlebars project Handlebars, Handlebars.Js Project Handlebars.Js or handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- handlebars (npm): upgrade to 4.0.0 or later

  ```sh
  npm install handlebars@4.0.0
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in Handlebars.js before version 4.0.0 due to improper escaping of unquoted attributes in templates. The root cause is located in 'lib/handlebars/utils.js', where the library fails to sufficiently neutralize input when a template attribute is not wrapped in quotes. A remote attacker can exploit this by providing malicious input that is rendered into an unquoted attribute, leading to the execution of arbitrary JavaScript in the context of the victim's browser. This is a network-based attack that typically requires user interaction (viewing the rendered page). The issue is resolved in Handlebars version 4.0.0.

## Affected products

- Handlebars project handlebars.js < 4.0.0

## Identifiers

- CVE-2015-8861
- GHSA-9prh-257w-9277

## Timeline

- 2015-08-12: patched: Handlebars 4.0.0 released addressing the issue
- 2016-04-20: disclosed: Public disclosure via oss-security mailing list
- 2017-01-23: advisory: NVD published CVE-2015-8861

## References

- [http://www.openwall.com/lists/oss-security/2016/04/20/11](http://www.openwall.com/lists/oss-security/2016/04/20/11)
- [http://www.securityfocus.com/bid/96434](http://www.securityfocus.com/bid/96434)
- [https://www.sourceclear.com/blog/handlebars_vulnerability_research_findings/](https://www.sourceclear.com/blog/handlebars_vulnerability_research_findings/)
- [https://www.tenable.com/security/tns-2016-18](https://www.tenable.com/security/tns-2016-18)

## Related threats

- [Handlebars AST validation bypass in compile and precompile](https://junglewise.ai/threats/cve-2026-106446-handlebars-provides-the-power-necessary-to-let-users-build)
- [Handlebars prototype pollution RCE via constructor bypass](https://junglewise.ai/threats/cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build)
- [Handlebars precompile script injection in generated code](https://junglewise.ai/threats/cve-2026-106444-handlebars-provides-the-power-necessary-to-let-users-build)
- [Handlebars.js prototype method access control gap via missing __lookupSetter__](https://junglewise.ai/threats/handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407)
- [Handlebars.js property access validation bypass in container.lookup](https://junglewise.ai/threats/handlebars-js-property-access-validation-bypass-in-container-lookup-25bcfec0)