Cross-Site Scripting

Overview

Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.

Proof of Concept

Template:
<a href />

Input:
{ 'foo' : 'test.com onload=alert(1)'}

Rendered result:
<a href />

Recommendation

Update to version 4.0.0 or later.
Alternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.

References

• SourceClear - Handlebars Research Findings
• PR #1083
• GitHub Advisory