Skip to content
Threat Feed
Subscribe

Vendor

Handlebarsjs

1 brief RSS
critical advisory

Handlebars.js Remote Code Execution via AST Injection

Handlebars.js versions 4.0.0 through 4.7.8 are vulnerable to remote code execution via a crafted AST that injects arbitrary JavaScript through the `Handlebars.compile()` function.

PoC handlebars rce ast-injection javascript
2r 1t 1c updated