GHSA-q42p-pg8m-cqh6
Prototype Pollution in handlebars
- Severity
- 7.3 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-471 Modification of Assumed-Immutable Data (MAID)
- Fix
4.1.2- Upgrade handlebars to this version or later
Description
Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.
Recommendation
For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| handlebars | >= 4.1.0, < 4.1.2 |
4.1.2 |
| handlebars | >= 4.0.0, < 4.0.14 |
4.0.14 |
| handlebars | < 3.0.7 |
3.0.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
handlebars npm → 4.1.2
- npm
npm install handlebars@4.1.2- yarn
yarn add handlebars@4.1.2- pnpm
pnpm add handlebars@4.1.2
Severity breakdown
CVSS 3.1 7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-471: Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
How to prevent it
- Architecture and Design, Operation, Implementation: When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.
References
Other links
- github.com/handlebars-lang/handlebars.js/issues/1495
- github.com/handlebars-lang/handlebars.js/commit/0d6d8c335ad81bad1b672fc56b6a44f…
- github.com/handlebars-lang/handlebars.js/commit/7372d4e9dffc9d70c09671aa28b9392…
- github.com/handlebars-lang/handlebars.js/commit/85c8783b34fc6d36145d8b53885ad0b…
- github.com/handlebars-lang/handlebars.js/commit/cd38583216dce325283191632320274…
- snyk.io/vuln/SNYK-JS-HANDLEBARS-173692
- npmjs.com/advisories/755
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8r5x-fm3f-whwj Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) | Critical | Also affects handlebars |
| GHSA-p8wg-vrv2-v86f Handlebars: JavaScript Injection via Own Property Check Bypass | Critical | Also affects handlebars |
| GHSA-xw65-4hp5-5hc7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | Medium | Also affects handlebars |
| GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry | Medium | Also affects handlebars |
| GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup | Low | Also affects handlebars |
| GHSA-xjpj-3mr7-gcpf Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | High | Also affects handlebars |
| GHSA-xhpv-hc6g-r9c6 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | High | Also affects handlebars |
| GHSA-9cx6-37pm-9jff Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | High | Also affects handlebars |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor