Executive brief
jsrender is a lightweight templating library used to dynamically generate HTML and text on web pages. When jsrender processes user-supplied input in templates, an attacker can inject malicious code that executes on the server or client, allowing them to read sensitive data, modify content, or compromise the affected system entirely.
Technical details
jsrender is vulnerable to template injection (CWE-94) when user input is dynamically embedded into server-delivered client-side templates without proper sanitization. An attacker can use constructor-chain manipulation (accessing constructor.constructor to invoke arbitrary code) or other JavaScript introspection techniques to break out of the template sandbox and execute arbitrary code. The vulnerability affects all versions prior to 0.9.74 and requires only network access—no authentication is needed if templates are publicly accessible. An attacker can achieve remote code execution by crafting a malicious template payload that exploits the template rendering engine. The fix was released in version 0.9.74, which restricts access to dangerous APIs and improves template expression evaluation.
Affected products
- Boris Moore jsrender < 0.9.74
Timeline
- 2020-09-01: disclosed: Advisory GHSA-r87w-47m8-22w3 published
- 2016-03-20: patched: Patch released in version 0.9.74