Handlebars.js présente une injection JavaScript via une confusion de type AST en manipulant @partial-block

The vulnerability stems from the mishandling of the @partial-block special variable. Attackers can exploit this by crafting a malicious Handlebars AST (Abstract Syntax Tree) and overwriting the @partial-block variable within the template data context. Subsequently, when {{> @partial-block}} is invoked, the crafted AST is compiled and executed, leading to arbitrary JavaScript execution on the server. This can result in complete system compromise, including data exfiltration, privilege escalation, and denial of service. The impact is particularly severe in applications that dynamically generate templates from untrusted sources, as an attacker could inject malicious code directly into the rendering pipeline.

Applications built with Node.js that utilize Handlebars.js for server-side rendering are at risk, particularly those that dynamically generate templates from user-supplied data or external sources. Legacy applications using older versions of Handlebars.js are especially vulnerable, as are those that haven't implemented robust input validation and sanitization practices.

• nodejs / server:

  ps aux | grep handlebars
  find / -name "handlebars.js" -print

• nodejs / supply-chain:

  npm ls handlebars
  npm audit handlebars

• generic web: Inspect server logs for unusual JavaScript execution patterns or errors related to Handlebars template compilation.

1. 2026-03-27Disclosure

   disclosure

1. Réservé2026-03-24
2. Publiée2026-03-27
3. Modifiée2026-04-01
4. EPSS mis à jour2026-04-04

The primary mitigation is to upgrade to Handlebars.js version 4.7.9 or later, which addresses the vulnerability. If upgrading is not immediately feasible, consider using the runtime-only build (require('handlebars').create().compile('...')) as this prevents the compilation of ASTs. Additionally, carefully validate and sanitize any objects passed to Handlebars helpers to prevent attackers from injecting malicious ASTs. Implement strict input validation for all template data to minimize the attack surface. Consider using a Web Application Firewall (WAF) to detect and block requests containing suspicious Handlebars template code.

Dernière mise à jour

4.7.9récemment