GHSA-xw65-4hp5-5hc7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

• npm handlebars: >= 4.0.0, < 4.7.10 → fixed in 4.7.10

Summary `Handlebars.precompile()` generates JavaScript source that is commonly embedded in browser `` elements. Before the fix, static template text containing `` was emitted unchanged. HTML parsers recognize `` even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed. This affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML `` element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files. Details Static text is serialized by `quotedString()` in `lib/handlebars/compiler/code-gen.js`. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence `` terminates the element regardless of JavaScript string context. On affected releases, this template: ```handlebars safealert("XSS") ``` could produce generated source containing: ```js return 'safealert("XSS")'; ``` When included inline in an HTML document, the first `` closes the script containing the precompiled template. The next `` element is then parsed as HTML and executes. Proof of Concept ```js const Handlebars = require('handlebars'); const template = 'safealert("XSS")'; const output = Handlebars.precompile(template); console.log(output.includes('')); ``` Affected versions print `true`. Embedding `output` directly in an inline `` element allows the injected script tag to be parsed by the browser. Workarounds • Do not inline precompiled output from untrusted templates into HTML documents. • Serve generated precompiled templates as external JavaScript files where practical. Credits Reported by Curly-Haired-Baboon Aka Laplas