Executive brief
Handlebars is a widely-used templating engine for JavaScript applications. When compiling untrusted templates with certain options, an attacker can exploit prototype pollution to inject malicious properties into JavaScript objects, potentially leading to arbitrary code execution or data exposure across the application.
Technical details
This vulnerability is a prototype pollution flaw (CWE-1321) in the Handlebars templating library when compiling templates from untrusted sources under specific compilation options. The vulnerable component is the JavaScript compiler that processes template options, failing to properly escape property names. An attacker who can control template input to the compiler can inject properties into the Object prototype, affecting all JavaScript objects in the application. The attack requires specific compilation options to be enabled but does not require authentication or user interaction. Fix is available in version 4.7.7 and later.
Affected products
- Handlebars Handlebars before 4.7.7
Timeline
- 2021-05-04: disclosed: Published to NVD
- 2021-05-19: patched: Fix released in Handlebars 4.7.7