GHSA-q2c6-c6pm-g3gh Arbitrary Code Execution in handlebars
Attackers can execute arbitrary JavaScript by submitting malicious templates to the handlebars library, affecting both server-side and client-side applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-q2c6-c6pm-g3gh?
GHSA-q2c6-c6pm-g3gh is a code injection vulnerability in handlebars, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a previous issue. This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).
Recommendation
Upgrade to version 3.0.8, 4.5.3 or later.
Which versions are affected by GHSA-q2c6-c6pm-g3gh?
4 open source packages ship an affected version, including handlebars.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | All versions | 3.0.8 |
handlebars npm | All versions | 3.0.8 |
handlebars npm | From 4.0.0 | 4.5.3 |
handlebars npm | From 4.0.0 | 4.5.3 |
How do I fix GHSA-q2c6-c6pm-g3gh?
Upgrade handlebars to a fixed version for your release line: 3.0.8 or 4.5.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-q2c6-c6pm-g3gh being exploited?
There is no known exploitation of GHSA-q2c6-c6pm-g3gh in the wild and no public exploit code.