https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:46:59 +0000 https://vulnerability.circl.lu/vuln/ghsa-xhpv-hc6g-r9c6 <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>A crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup.</p> <p>## Description</p> <p>The vulnerable code path spans two functions in `lib/handlebars/runtime.js`:</p> <p>**`resolvePartial()`:** A crafted object with `call: true` satisfies the first branch condition (`partial.call`) and causes an early return of the original object itself, because none of the remaining conditionals (string check, `options.partials` lookup, etc.) match a plain object. The function returns the crafted object as-is.</p> <p>**`invokePartial()`:** When `resolvePartial` returns a non-function object, `invokePartial` produces `undefined`. The runtime interprets `undefined` as &#34;partial not yet compiled&#34; and calls `env.compile(partial, ...)` where `partial` is the crafted AST object. The JavaScript code generator processes the AST and emits JavaScript containing the injected payload, which is then evaluated.</p> <p>**Minimum prerequisites:** 1. The template uses a dynamic partial lookup: `{{&gt; (lookup . &#34;key&#34;)}}` or equivalent. 2. The adversary…</p> <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>A crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup.</p> <p>## Description</p> <p>The vulnerable code path spans two functions in `lib/handlebars/runtime.js`:</p> <p>**`resolvePartial()`:** A crafted object with `call: true` satisfies the first branch condition (`partial.call`) and causes an early return of the original object itself, because none of the remaining conditionals (string check, `options.partials` lookup, etc.) match a plain object. The function returns the crafted object as-is.</p> <p>**`invokePartial()`:** When `resolvePartial` returns a non-function object, `invokePartial` produces `undefined`. The runtime interprets `undefined` as &#34;partial not yet compiled&#34; and calls `env.compile(partial, ...)` where `partial` is the crafted AST object. The JavaScript code generator processes the AST and emits JavaScript containing the injected payload, which is then evaluated.</p> <p>**Minimum prerequisites:** 1. The template uses a dynamic partial lookup: `{{&gt; (lookup . &#34;key&#34;)}}` or equivalent. 2. The adversary…</p> https://vulnerability.circl.lu/vuln/ghsa-xhpv-hc6g-r9c6