{"id":"GHSA-9prh-257w-9277","summary":"Cross-Site Scripting in handlebars","details":"Versions of `handlebars` prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.\n\n\n## Proof of Concept\nTemplate:\n```\u003ca href={{foo}}/\u003e```\n\nInput:\n```{ 'foo' : 'test.com onload=alert(1)'}```\n\nRendered result:\n```\u003ca href=test.com onload=alert(1)/\u003e```\n\n\n## Recommendation\n\nUpdate to version 4.0.0 or later.\nAlternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.","aliases":["CVE-2015-8861"],"modified":"2026-07-17T21:11:32.497537655Z","published":"2018-10-23T17:20:12Z","database_specific":{"github_reviewed_at":"2020-06-16T21:29:14Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8861"},{"type":"WEB","url":"https://github.com/wycats/handlebars.js/pull/1083"},{"type":"WEB","url":"https://blog.srcclr.com/handlebars_vulnerability_research_findings"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9prh-257w-9277"},{"type":"PACKAGE","url":"https://github.com/wycats/handlebars.js"},{"type":"WEB","url":"https://www.npmjs.com/advisories/61"},{"type":"WEB","url":"https://www.sourceclear.com/blog/handlebars_vulnerability_research_findings"},{"type":"WEB","url":"https://www.tenable.com/security/tns-2016-18"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/04/20/11"},{"type":"WEB","url":"http://www.securityfocus.com/bid/96434"}],"affected":[{"package":{"name":"handlebars","ecosystem":"npm","purl":"pkg:npm/handlebars"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-9prh-257w-9277/GHSA-9prh-257w-9277.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}