Executive brief
Handlebars is a popular templating engine used by web applications to generate dynamic content. A vulnerability in versions 4.0.0 through 4.4.4 allows attackers to supply specially crafted templates that force the parser into an infinite loop, consuming system resources and causing the application to become unresponsive or crash.
Technical details
The vulnerability is a Denial of Service (CWE-400: Uncontrolled Resource Consumption) in the Handlebars template parser. When processing specially-crafted templates, the parser can enter an endless loop that exhausts system resources (CPU, memory). The attack requires the application to accept and parse untrusted template input. The vulnerability affects Handlebars versions 4.0.0 through 4.4.4; a fix is available in version 4.4.5 and later.
Affected products
- Handlebars Handlebars 4.0.0 through 4.4.4
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fixed in version 4.4.5