Source: node-handlebars Version: 3:4.7.9-6 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for node-handlebars. CVE-2026-106444[0]: | Handlebars provides the power necessary to let users build semantic | templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses | quotedString() in lib/handlebars/compiler/code-gen.js to emit static | template text into generated JavaScript without escaping sequences | that terminate an enclosing HTML script element. When an application | precompiles attacker-controlled template text and embeds the | generated source directly in an inline script element, a closing | script delimiter can end the element and cause following attacker- | controlled markup to be parsed and executed. Ordinary server-side | rendering and precompiled templates served as external JavaScript | files are not affected. This issue is fixed in version 4.7.10. CVE-2026-106445[1]: | Handlebars provides the power necessary to let users build semantic | templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty | returns Function.prototype.constructor before applying the | prototype-access deny list because constructor is an own property of | Function.prototype. When an attacker can render a controlled | template with allowProtoMethodsByDefault enabled and an accessible | function in the template context, the template can traverse from | that function through its prototype to Function.prototype and then | obtain the Function constructor through the own-property bypass. | This permits attacker-controlled JavaScript to execute with the | server application's privileges. This issue is fixed in version | 4.7.10. CVE-2026-106446[2]: | Handlebars provides the power necessary to let users build semantic | templates. From 4.0.0 until 4.7.10, Handlebars.compile() and | Handlebars.precompile() accept pre-parsed AST objects while | validating only selected PathExpression, NumberLiteral, and | BooleanLiteral values. This issue bypasses the AST validation | introduced in version 4.7.9 for CVE-2026-33937. An attacker who can | supply an object instead of a template string can place JavaScript | expressions in unchecked values such as Program.blockParams.length, | a non-PathExpression parameter depth, a non-string | StringLiteral.value, or a non-string PathExpression.original. The | compiler emits those values into generated JavaScript, causing code | execution in the server process when compile output renders or | wherever precompile output is loaded. Applications that pass only | template strings are not affected. This issue is fixed in version | 4.7.10. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-106444 https://www.cve.org/CVERecord?id=CVE-2026-106444 [1] https://security-tracker.debian.org/tracker/CVE-2026-106445 https://www.cve.org/CVERecord?id=CVE-2026-106445 [2] https://security-tracker.debian.org/tracker/CVE-2026-106446 https://www.cve.org/CVERecord?id=CVE-2026-106446 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
