Executive brief
Handlebars is a popular JavaScript templating engine used to dynamically generate HTML and other content. A prototype pollution vulnerability allows anyone with the ability to create or modify Handlebars templates to execute arbitrary code on the server, potentially accessing the file system, spawning processes, or making network connections. This is critical in environments where templates are user-controlled or trust is assumed.
Technical details
The vulnerability is a prototype pollution flaw (CWE-471) in Handlebars versions prior to 3.0.7, 4.0.14, and 4.1.2. By accessing an object's constructor property within a template, an attacker can fabricate and execute arbitrary JavaScript functions. The vulnerability requires template authorship or modification privileges but no network traversal or authentication; in Node.js environments, this enables file system access, process spawning, and network operations. The fix restricts access to the constructor property. Affected versions: 0–3.0.6, 4.0.0–4.0.13, and 4.1.0–4.1.1. Patches are available in 3.0.7, 4.0.14, and 4.1.2+.
Affected products
- Handlebars Handlebars prior to 3.0.7, 4.0.14, and 4.1.2
Timeline
- 2019-02-07: disclosed: Vulnerability reported to npm-security
- 2019-06-05: patched: Fixes released in versions 3.0.7, 4.0.14, and 4.1.2