GHSA-q2c6-c6pm-g3gh

Arbitrary Code Execution in handlebars

At a glance

Published: 2020-09-04 15:07 UTC
Updated: 2026-09-10 03:48 UTC

Description

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting). ## Recommendation Upgrade to version 3.0.8, 4.5.3 or later.

Affected packages

Package	Versions
npm · handlebars	introduced 0, fixed 3.0.8
npm · handlebars	introduced 4.0.0, fixed 4.5.3

References

https://www.npmjs.com/advisories/1324 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database