Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 5 June 2019.

Which products and versions are affected?

handlebars (npm) SEMVER:introduced=4.1.0,fixed=4.1.2.

Is there a fix for This vulnerability?

Yes. handlebars (npm): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Handlebars prototype pollution remote code execution

Severity: low · CVSS 3.1 · Published 2019-06-05

Handlebars is a popular JavaScript templating engine used to dynamically generate HTML and other content. A prototype pollution vulnerability allows anyone with the ability to create or modify Handlebars templates to execute arbitrary code on the server, potentially accessing the file system, spawning processes, or making network connections. This is critical in environments where templates are user-controlled or trust is assumed.

Technologies: handlebars (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 5 June 2019.
Which products and versions are affected?: handlebars (npm) SEMVER:introduced=4.1.0,fixed=4.1.2.
Is there a fix for This vulnerability?: Yes. handlebars (npm): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

handlebars (npm): upgrade to 4.1.2 or later
```
npm install handlebars@4.1.2
```

Technical details

The vulnerability is a prototype pollution flaw (CWE-471) in Handlebars versions prior to 3.0.7, 4.0.14, and 4.1.2. By accessing an object's constructor property within a template, an attacker can fabricate and execute arbitrary JavaScript functions. The vulnerability requires template authorship or modification privileges but no network traversal or authentication; in Node.js environments, this enables file system access, process spawning, and network operations. The fix restricts access to the constructor property. Affected versions: 0–3.0.6, 4.0.0–4.0.13, and 4.1.0–4.1.1. Patches are available in 3.0.7, 4.0.14, and 4.1.2+.

Affected products

Handlebars Handlebars prior to 3.0.7, 4.0.14, and 4.1.2

Timeline

2019-02-07: disclosed: Vulnerability reported to npm-security
2019-06-05: patched: Fixes released in versions 3.0.7, 4.0.14, and 4.1.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.