NodeJS/handlebars/3.0.8

Remote code execution in Handlebars.js

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Prototype Pollution in handlebars

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Cross-Site Scripting in handlebars

Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.

Proof of Concept

Template: <a href={{foo}}/>

Input: { 'foo' : 'test.com onload=alert(1)'}

Rendered result: <a href=test.com onload=alert(1)/>

Recommendation

Update to version 4.0.0 or later. Alternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.

Remote code execution in handlebars when compiling templates

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Moderate severity vulnerability that affects handlebars

Withdrawn: Duplicate of GHSA-9prh-257w-9277

Denial of Service

Crash Node.js process from handlebars using a small and simple source

Quoteless Attributes in Templates can lead to Content Injection

Not using quotes around your attributes in handlebar templates, could lead to content injection.

Example

Template: <a href={{foo}}/>

Input: { 'foo' : 'test.com onload=alert(1)'}

Rendered result: <a href=test.com onload=alert(1)/>