https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 18:59:00 +0000 https://db.gcve.eu/vuln/ghsa-3mfm-83xf-c92r <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>The `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{&gt; @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server.</p> <p>## Description</p> <p>Handlebars stores `@partial-block` in the `data` frame that is accessible to templates. In nested contexts, a parent frame&#39;s `@partial-block` is reachable as `@_parent.partial-block`. Because the data frame is a mutable object, any registered helper that accepts an object reference and assigns properties to it can overwrite `@partial-block` with an attacker-controlled value.</p> <p>When `{{&gt; @partial-block}}` is subsequently evaluated, `invokePartial` receives the crafted object. The runtime, finding an object that is not a compiled function, falls back to **dynamically compiling** the value via `env.compile()`. If that value is a well-formed Handlebars AST containing injected code, the injected JavaScript runs in the server process.</p> <p>The `handlebars-helpers` npm package (commonly used with Handlebars) includes several helpers such as `merge` that can be used as the mutation primitive.</p> <p>## Proof of Concept</p> <p>Tested with Handlebars 4.7.8 and `handlebars-helpers`:</p> <p>```javascript const Handlebars = require(&#39;handlebars&#39;); const merge = require(&#39;handlebars-helpers&#39;).object().merge; H…</p> <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>The `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{&gt; @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server.</p> <p>## Description</p> <p>Handlebars stores `@partial-block` in the `data` frame that is accessible to templates. In nested contexts, a parent frame&#39;s `@partial-block` is reachable as `@_parent.partial-block`. Because the data frame is a mutable object, any registered helper that accepts an object reference and assigns properties to it can overwrite `@partial-block` with an attacker-controlled value.</p> <p>When `{{&gt; @partial-block}}` is subsequently evaluated, `invokePartial` receives the crafted object. The runtime, finding an object that is not a compiled function, falls back to **dynamically compiling** the value via `env.compile()`. If that value is a well-formed Handlebars AST containing injected code, the injected JavaScript runs in the server process.</p> <p>The `handlebars-helpers` npm package (commonly used with Handlebars) includes several helpers such as `merge` that can be used as the mutation primitive.</p> <p>## Proof of Concept</p> <p>Tested with Handlebars 4.7.8 and `handlebars-helpers`:</p> <p>```javascript const Handlebars = require(&#39;handlebars&#39;); const merge = require(&#39;handlebars-helpers&#39;).object().merge; H…</p> https://db.gcve.eu/vuln/ghsa-3mfm-83xf-c92r