Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

Affected: npm: handlebars

## Summary

`Handlebars.precompile()` generates JavaScript source that is commonly embedded in browser `<script>` elements. Before the fix, static template text containing `</script>` was emitted unchanged. HTML parsers recognize `</script>` even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed.

This affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML `<script>` element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files.

## Details

Static text is serialized by `quotedString()` in `lib/handlebars/compiler/code-gen.js`. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence `</script>` terminates the element regardless of JavaScript string context.

On affected releases, this template:

```handlebars safe</script><script>alert("XSS")</script><script> ```

could produce generated source containing:

```js return 'safe</script><script>alert("XSS")</script><script>'; ```

When included inline in an HTML document, the first `</script>` closes the script containing the precompiled template. The next `<script>` element is then parsed as HTML and executes.

## Proof of Concept

```js const Handlebars = require('handlebars');

const template = 'safe</script><script>alert("…

Affected: Ubuntu:16.04:LTS: ruby-handlebars-assets, Ubuntu:18.04:LTS: node-handlebars, Ubuntu:18.04:LTS: ruby-handlebars-assets, Ubuntu:20.04:LTS: node-handlebars, Ubuntu:20.04:LTS: ruby-handlebars-assets, Ubuntu:22.04:LTS: node-handlebars, Ubuntu:22.04:LTS: ruby-handlebars-assets, Ubuntu:24.04:LTS: node-handlebars, Ubuntu:24.04:LTS: ruby-handlebars-assets, Ubuntu:26.10: node-handlebars and 1 more

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.