# Handlebars arbitrary code execution in lookup helper

Source: https://junglewise.ai/threats/handlebars-arbitrary-code-execution-in-lookup-helper-e5650e93  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-04. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2020-09-04

Handlebars is a popular web templating engine used to generate dynamic HTML or text. A security flaw in how it processes templates allows an attacker to run unauthorized code on the server or in a user's web browser. This could lead to data theft, unauthorized system access, or malicious scripts being executed against website visitors.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 4 September 2020.

**Which products and versions are affected?** Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.2.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Handlebars versions prior to 3.0.8 and 4.5.2 are vulnerable to arbitrary code execution (CWE-94) via the 'lookup' helper. The vulnerability stems from insufficient validation of templates, which allows an attacker to bypass the sandbox and access the JavaScript constructor. By submitting a specially crafted template, an attacker can execute arbitrary JavaScript in the context of the server-side process or as a Cross-Site Scripting (XSS) attack in a victim's browser. Exploitation requires the ability to provide or influence the template being rendered. Users should upgrade to version 3.0.8, 4.5.2, or later.

## Affected products

- Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.2

## Timeline

- 2020-09-04: advisory: Original advisory published on GitHub/OSV.

## References

- [https://www.npmjs.com/advisories/1316](https://www.npmjs.com/advisories/1316)