CVE-2026-6321

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a previous issue. This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Versions of handlebars prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:

	{{#with split as |a|}}
		{{pop (push "alert('Vulnerable Handlebars JS');")}}
		{{#with (concat (lookup join (slice 0 1)))}}
			{{#each (slice 2 3)}}
				{{#with (apply 0 a)}}
					{{.}}
				{{/with}}
			{{/each}}
		{{/with}}
	{{/with}}
{{/with}}```


## Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.

Impact

fast-uri v3.1.0 and earlier decodes percent-encoded path separators (%2F) and dot segments (%2E) before applying dot-segment removal in normalize() and equal(). This makes encoded path data behave like real / and .., so distinct URIs collapse onto the same normalized path.

For example, http://example.com/public/%2e%2e/admin normalizes to http://example.com/admin, and equal() considers them the same URI.

Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed. A path that looks confined under an allowed prefix can normalize to a different location.

Patches

Upgrade to fast-uri >= 3.1.1, or if you are in the v2.x release line, v2.4.1

Workarounds

None. Upgrade to the patched version.

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Recommendation

For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.

Root has patched CVE-2026-6321 in the fast-uri package for Root:npm. Multiple fixed versions available.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 1.3.0-tuxcare.1.

TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 1.0.12-tuxcare.2.

TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.0.1-tuxcare.1.

TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.0.3-tuxcare.1.

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 2.4.0-tuxcare.1.

TuxCare rebuilt dompurify to address 16 CVEs. Fixed in 2.4.0-tuxcare.1.

TuxCare rebuilt dompurify to address 34 CVEs. Fixed in 3.0.3-tuxcare.1.

TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 2.4.5-tuxcare.1.

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.0-tuxcare.1.

TuxCare rebuilt fast-uri to address 7 CVEs. Fixed in 3.0.6-tuxcare.2.

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a previous issue. This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

These are all security issues fixed in the python311-pydata-sphinx-theme-0.17.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the openQA-5.1782995932.ffeb09be-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-pydata-sphinx-theme fixes the following issues:

Changes in python-pydata-sphinx-theme:

• Refresh js dependencies:

  • ws to 7.5.11 (bsc#1268957, CVE-2026-48779)

• Refresh vendored tarball (CVE-2026-6321, bsc#1264374)

This update for openQA, os-autoinst fixes the following issues:

Changes in openQA:

• Update to version 5.1783076943.6691832d:

  • test: Stabilize t/05-scheduler-full.t

• Clarify resolution of three CVEs

  • The following CVEs have been fixed (see previous changelog entries that mentioned only the according Bugzilla tickets):
    • bsc#1259005 - CVE-2026-27904
    • bsc#1264376 - CVE-2026-6321
    • bsc#1258632 - CVE-2026-26996

• Update to version 5.1782995932.ffeb09be:

  • feat: throw 404 for nonexistent groups in overview
  • feat: Avoid logwarn notifications for non-critical auth error
  • chore(deps): Dependency cron 2026-07-02
  • git subrepo pull (merge) external/os-autoinst-common
  • fix: Check also hidden files in checklist plugin
  • test: Enable faster re-connects in full scheduler test consistently
  • test: Avoid silent daemons in verbose mode
  • test: Allow running t/43-…-scalability.t in parallel
  • test: Allow running t/05-scheduler-full.t in parallel
  • test: Avoid race condition when generating ports in 25-cache.t
  • test: Avoid wasting seconds in 40-script_load_dump_templates.t
  • refactor: Remove disabled code in openqa-load-templates
  • test: Avoid race condition when generating ports in many tests
  • chore(deps): Dependency cron 2026-07-01
  • fix(ci): format inline comments in workflows to pass yamllint
  • test: Avoid running into "Address already in use" in fullstack test
  • feat(ci): pin GitHub Actions by commit hash

Changes in os-autoinst:

• Update to version 5.1783082953.c3cb41d:

  • test: Disable unstable t/28-signalblocker.t on ppc64le OBS builds
  • fix: Check also hidden files in checklist plugin
  • feat(ci): disable Mergify interactive queue controls in PR comments
  • test: assert pipe size adjustment dynamically
  • test: assert terminal session boundary safety
  • refactor: support pretty markers in script_sudo and become_root
  • fix: mmapi test failures and infinite loop hangs
  • test: simplify Level 3 pretty marker detection
  • fix: exclude virt-firmware on all older Leap archs

• Update to version 5.1782917048.dcc97e9:

  • fix: Check also hidden files in checklist plugin
  • feat(ci): disable Mergify interactive queue controls in PR comments
  • fix(ci): format inline comments in workflows to pass yamllint
  • feat(ci): pin GitHub Actions by commit hash
  • test: assert pipe size adjustment dynamically
  • test: assert terminal session boundary safety
  • refactor: support pretty markers in script_sudo and become_root
  • fix: mmapi test failures and infinite loop hangs
  • test: simplify Level 3 pretty marker detection
  • fix: exclude virt-firmware on all older Leap archs

Root has patched GHSA-2cf5-4w76-r9qv in the handlebars package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-g9r4-xpmj-mj65 in the handlebars package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-q2c6-c6pm-g3gh in the handlebars package for Root:npm. Multiple fixed versions available.

Root has patched GHSA-q42p-pg8m-cqh6 in the handlebars package for Root:npm. Multiple fixed versions available.