GHSA-9prh-257w-9277
Cross-Site Scripting in handlebars
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | handlebars | < 4.0.0 | 4.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `handlebars` prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.
## Proof of Concept
Template:
```<a href={{foo}}/>```
Input:
```{ 'foo' : 'test.com onload=alert(1)'}```
Rendered result:
```<a href=test.com onload=alert(1)/>```
## Recommendation
Update to version 4.0.0 or later.
Alternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2015-8861
- https://github.com/wycats/handlebars.js/pull/1083
- https://blog.srcclr.com/handlebars_vulnerability_research_findings
- https://github.com/advisories/GHSA-9prh-257w-9277
- https://github.com/wycats/handlebars.js
- https://www.npmjs.com/advisories/61
- https://www.sourceclear.com/blog/handlebars_vulnerability_research_findings
- https://www.tenable.com/security/tns-2016-18
- http://www.openwall.com/lists/oss-security/2016/04/20/11
- http://www.securityfocus.com/bid/96434