Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

## Summary `Handlebars.precompile()` generates JavaScript source that is commonly embedded in browser `<script>` elements. Before the fix, static template text containing `</script>` was emitted unchanged. HTML parsers recognize `</script>` even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed. This affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML `<script>` element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files. ## Details Static text is serialized by `quotedString()` in `lib/handlebars/compiler/code-gen.js`. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence `</script>` terminates the element regardless of JavaScript string context. On affected releases, this template: ```handlebars safe</script><script>alert("XSS")</script><script> ``` could produce generated source containing: ```js return 'safe</script><script>alert("XSS")</script><script>'; ``` When included inline in an HTML document, the first `</script>` closes the script containing the precompiled template. The next `<script>` element is then parsed as HTML and executes. ## Proof of Concept ```js const Handlebars = require('handlebars'); const template = 'safe</script><script>alert("XSS")</script><script>'; const output = Handlebars.precompile(template); console.log(output.includes('</script>')); ``` Affected versions print `true`. Embedding `output` directly in an inline `<script>` element allows the injected script tag to be parsed by the browser. ## Workarounds - Do not inline precompiled output from untrusted templates into HTML documents. - Serve generated precompiled templates as external JavaScript files where practical. ## Credits Reported by Curly-Haired-Baboon Aka Laplas

Source published

8 Oct 2026 17:52:37 UTC

Source modified

8 Oct 2026 18:00:09 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Publisher rating · MODERATE