GHSA-2w6w-674q-4c4q — Handlebars.js has JavaScript Injection via AST Type Confusion

Affected: npm: handlebars

## Summary

`Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.

## Description

`Handlebars.compile()` accepts either a template string or a pre-parsed AST. When an AST is supplied, the JavaScript code generator in `lib/handlebars/compiler/javascript-compiler.js` emits `NumberLiteral` values verbatim:

```javascript // Simplified representation of the vulnerable code path: // NumberLiteral.value is appended to the generated code without escaping compiledCode += numberLiteralNode.value; ```

Because the value is not wrapped in quotes or otherwise sanitized, passing a string such as `{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //` as the `value` of a `NumberLiteral` causes the generated `eval`-ed code to break out of its intended context and execute arbitrary commands.

Any endpoint that deserializes user-controlled JSON and passes the result directly to `Handlebars.compile()` is exploitable.

## Proof of Concept

Server-side Express application that passes `req.body.text` to `Handlebars.compile()`:

```Javascript import express from "express"; import Handlebars from "handlebars";

const app = express(); app.use(expr…

Most recent entries from all

GHSA-2w6w-674q-4c4q — Handlebars.js has JavaScript Injection via AST Type Confusion