Executive brief
Handlebars.js is a widely-used templating engine for Node.js and browsers. The library's compile() function can accept either a template string or a pre-parsed AST object. An attacker who controls the AST input—for example, through JSON deserialization of user data—can craft a malicious NumberLiteral node that executes arbitrary JavaScript code on the server, leading to complete system compromise including data theft and command execution.
Technical details
The vulnerability exists in lib/handlebars/compiler/javascript-compiler.js, where NumberLiteral AST node values are appended to generated code without quoting or sanitization. When a crafted AST with a malicious NumberLiteral value (e.g., "{},'}} + process.getBuiltinModule('child_process').execFileSync('id')") is passed to compile(), the injected code breaks out of its intended scope and executes with full privileges. The vulnerability affects versions 4.0.0 through 4.7.8. Attack requires the application to deserialize untrusted JSON and pass it directly to Handlebars.compile()—a pattern common in REST APIs that accept template definitions from clients. No user interaction is required; exploitation is immediate upon request. Patch available in v4.7.9 (released 2026-03-26); workaround is to validate input type and only accept strings, never pre-parsed objects.
Affected products
- Handlebars handlebars.js 4.0.0 to 4.7.8
Timeline
- 2026-03-27: disclosed: GHSA published
- 2026-03-26: patched: v4.7.9 released with fix
- 2026-03-27: kev added
References
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q
- https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
- https://github.com/handlebars-lang/handlebars.js
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9