Executive brief
Handlebars is a popular web templating engine used to generate dynamic HTML or text. A security flaw in how it processes templates allows an attacker to run unauthorized code on the server or in a user's web browser. This could lead to data theft, unauthorized system access, or malicious scripts being executed against website visitors.
Technical details
Handlebars versions prior to 3.0.8 and 4.5.2 are vulnerable to arbitrary code execution (CWE-94) via the 'lookup' helper. The vulnerability stems from insufficient validation of templates, which allows an attacker to bypass the sandbox and access the JavaScript constructor. By submitting a specially crafted template, an attacker can execute arbitrary JavaScript in the context of the server-side process or as a Cross-Site Scripting (XSS) attack in a victim's browser. Exploitation requires the ability to provide or influence the template being rendered. Users should upgrade to version 3.0.8, 4.5.2, or later.
Affected products
- Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.2
Timeline
- 2020-09-04: advisory: Original advisory published on GitHub/OSV.