Executive brief
rendr is a JavaScript templating and rendering framework used to build isomorphic web applications. A cross-site scripting vulnerability in client-side block template rendering allows attackers to inject malicious scripts that execute in users' browsers when content is rendered on the client side, bypassing the safe server-side escaping mechanism.
Technical details
The vulnerability exists in rendr's client-side rendering of block templates (CWE-79: Cross-site Scripting). When HTML content is passed to a _block placeholder in a Handlebars template and rendered on the client using jQuery's .html() method, the browser automatically unescapes HTML entities during DOM insertion. Although the server-side rendering properly escapes content, the client-side pathway fails to account for this double-unescaping behavior, allowing pre-escaped malicious payloads (e.g., "<script>") to be unescaped and executed in the client context. No authentication is required; the attack triggers during normal client-side navigation to pages containing vulnerable block templates. The vulnerability is fixed in version 1.1.4 and later by double-escaping data attributes in the client-side view placeholder.
Affected products
- Rendr rendr before 1.1.4
Timeline
- 2020-09-01: disclosed
- 2020-09-01: patched