Listen to this Post
Handlebars provides powerful functionality for building semantic templates via precompilation.
The vulnerability stems from how static template text is handled during generation.
Specifically, `Handlebars.precompile()` utilizes the `quotedString()` helper function.
This function resides within the `lib/handlebars/compiler/code-gen.js` module.
During compilation, static text segments are serialized into JavaScript strings.
However, the generated JavaScript quoting alone fails to account for HTML contexts.
HTML parsers inspect inline script content for closing tag sequences.
Crucially, the sequence `` terminates the script element prematurely.
This recognition happens even when the sequence sits inside a JavaScript string literal.
When an application embeds precompiled template output inline inside an HTML document,
the injected closing tag tricks the browser’s HTML parser completely.
The browser treats the first `` instance as the end of the script block.
Any subsequent markup provided in the template is then parsed as standard HTML.
This permits malicious actors to execute arbitrary injected scripts in the browser.
Applications that precompile attacker-controlled templates are primarily affected.
If the generated source is placed directly inside an HTML `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.