Sign in
Deutsch English Español Polski
Medium

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

  • Disclosed: 26.03.2026
  • Updated: 11.10.2026 10:22

Summary

resolvePartial() in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS.

Description

The root cause is in lib/handlebars/runtime.js inside resolvePartial() and invokePartial():

js
// Vulnerable: plain bracket access traverses Object.prototype
partial = options.partials[options.name];

hasOwnProperty is never checked, so if Object.prototype has been seeded with a key whose name matches a partial reference in the template (e.g. widget), the lookup succeeds and the polluted string is returned. The runtime emits a prototype-access warning, but the partial is still resolved and its content is inserted into the rendered output unescaped. This contradicts the documented security model and is distinct from CVE-2021-23369 and CVE-2021-23383, which addressed data property access rather than partial template resolution.

Prerequisites for exploitation:

  1. The target application must be vulnerable to prototype pollution (e.g. via qs, minimist, or any querystring/JSON merge sink).
  2. The attacker must know or guess the name of a partial reference used in a template.

Proof of Concept

js
const Handlebars = require('handlebars');

// Step 1: Prototype pollution (via qs, minimist, or another vector)
Object.prototype.widget = '<img src=x onerror="alert(document.domain)">';

// Step 2: Normal template that references a partial
const template = Handlebars.compile('<div>Welcome! {{> widget}}</div>');

// Step 3: Render — XSS payload injected unescaped
const output = template({});
// Output: <div>Welcome! <img src=x onerror="alert(document.domain)"></div>

The runtime prints a prototype access warning claiming "access has been denied," but the partial still resolves and returns the polluted value.

Workarounds

  • Apply Object.freeze(Object.prototype) early in application startup to prevent prototype pollution. Note: this may break other libraries.
  • Use the Handlebars runtime-only build (handlebars/runtime), which does not compile templates and reduces the attack surface.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package handlebars >= 4.0.0, < 4.7.9 4.7.9

References

CVSS score 4.7/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-1321, CWE-79
Platform
npm
Package
handlebars
Disclosed
26.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-2qvq-rjwj-gvw9 - CC BY 4.0

Vulnerability history: handlebars

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (22) in the archive
Total entries
22
First → latest
10.2018 10.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 6
  • High 10
  • Medium 5
  • Low 1

Disclosures per year

Severity:
  1. Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
    Critical · 9.8 CVE-2026-106446 >= 4.0.0, < 4.7.10 4.7.10
  2. Handlebars: JavaScript Injection via Own Property Check Bypass
    Critical CVE-2026-106445 >= 3.0.0, < 4.7.10 4.7.10
  3. Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
    High · 8.2 CVE-2026-33941 >= 4.0.0, < 4.7.9 4.7.9
  4. Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
    High · 8.1 CVE-2026-33940 >= 4.0.0, < 4.7.9 4.7.9
  5. Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
    High · 7.5 CVE-2026-33939 >= 4.0.0, < 4.7.9 4.7.9
  6. Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
    High · 8.1 CVE-2026-33938 >= 4.0.0, < 4.7.9 4.7.9
  7. Handlebars.js has JavaScript Injection via AST Type Confusion
    Critical · 9.8 CVE-2026-33937 >= 4.0.0, < 4.7.9 4.7.9
  8. Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection this entry
    Medium · 4.7 CVE-2026-33916 >= 4.0.0, < 4.7.9 4.7.9
  9. Prototype Pollution in handlebars
    Critical · 9.8 CVE-2021-23383 < 4.7.7 4.7.7
  10. Regular Expression Denial of Service in Handlebars
    High · 7.5 CVE-2019-20922 >= 4.0.0, < 4.4.5 4.4.5
  11. Arbitrary Code Execution in Handlebars
    High · 8.1 CVE-2019-20920 < 3.0.8, >= 4.0.0, < 4.5.3 3.0.8, 4.5.3
  12. Remote code execution in handlebars when compiling templates
    Critical · 9.8 CVE-2021-23369 < 4.7.7 4.7.7
  13. Arbitrary Code Execution in handlebars
    High ghsa-q2c6-c6pm-g3gh < 3.0.8, >= 4.0.0, < 4.5.3 3.0.8, 4.5.3
  14. Prototype Pollution in handlebars
    High ghsa-g9r4-xpmj-mj65 < 3.0.8, >= 4.0.0, < 4.5.3 3.0.8, 4.5.3
  15. Arbitrary Code Execution in handlebars
    High · 7.3 ghsa-2cf5-4w76-r9qv < 3.0.8, >= 4.0.0, < 4.5.2 3.0.8, 4.5.2
  16. Prototype Pollution in handlebars
    Critical · 9.8 CVE-2019-19919 >= 4.0.0, < 4.3.0, < 3.0.8 4.3.0, 3.0.8
  17. Prototype Pollution in handlebars
    High · 7.3 ghsa-q42p-pg8m-cqh6 >= 4.1.0, < 4.1.2, >= 4.0.0, < 4.0.14, < 3.0.7 4.1.2, 4.0.14, 3.0.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.