Executive brief
Handlebars is a popular JavaScript templating engine used in web applications and build systems. Versions prior to 4.3.0 (and 3.0.8 for the 3.x line) allow malicious templates to modify JavaScript's core prototype objects, enabling attackers to execute arbitrary code on any system processing the template. This affects all applications using vulnerable handlebars versions.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-74) in the Handlebars templating engine. Attackers can craft templates that modify __proto__ and __defineGetter__ properties on built-in JavaScript objects, achieving remote code execution. The vulnerability requires no authentication or user interaction—any template processing untrusted input is exploitable. The attack vector is network-based when templates are received from external sources. Patches are available: upgrade to handlebars 4.3.0 or later for 4.x versions, or 3.0.8 for 3.x versions.
Affected products
- Handlebars handlebars < 3.0.8, >= 4.0.0 < 4.3.0
- Nerian bootstrap-wysihtml5-rails 0.3.3.5 through 0.3.3.8
Timeline
- 2019-12-20: disclosed
- 2019-12-26: patched: Patches released for versions 3.0.8 and 4.3.0
- 2019-12-26: advisory