Server side template injection In node-handlebars
Description
Arbitrary Code Execution in Handlebars Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 14 | 3:4.5.3-1 | ||
debian 11 | 3:4.5.3-1 | ||
debian 12 | 3:4.5.3-1 | ||
debian 13 | 3:4.5.3-1 | ||
 npm | 3.0.8, 4.5.3 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5.