Executive brief
templ8 is a JavaScript template engine used to dynamically render templates on client and server. A prototype pollution vulnerability in its parse function allows attackers to inject malicious properties into JavaScript object prototypes, potentially causing denial of service, property injection attacks, or remote code execution depending on how the affected application uses the polluted properties.
Technical details
templ8 versions up to and including 0.0.44 are vulnerable to prototype pollution via the parse function, which processes template strings without properly sanitizing dangerous property names like __proto__, constructor, and prototype. An attacker can craft a malicious template (e.g., '{{__proto__.polluted=true}}') that, when parsed, injects arbitrary properties into Object.prototype and propagates them to all JavaScript objects in the application. This attack requires only network-level access and no authentication; the attacker simply needs to control or influence template content passed to the parse function. Depending on application logic, successful exploitation can lead to denial of service (by breaking inherited object methods), security bypass (by polluting access-control properties), or remote code execution (if polluted properties are later evaluated). No patched version is available; the package is unmaintained.
Affected products
- templ8 templ8 0.0.44 and earlier
Timeline
- 2020-08-17: disclosed: Published by Snyk and NVD
- 2021-05-06: advisory: GitHub security advisory GHSA-c7m7-4257-h698 published