CVE-2026-65902

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a previous issue. This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

Versions of handlebars prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:

	{{#with split as |a|}}
		{{pop (push "alert('Vulnerable Handlebars JS');")}}
		{{#with (concat (lookup join (slice 0 1)))}}
			{{#each (slice 2 3)}}
				{{#with (apply 0 a)}}
					{{.}}
				{{/with}}
			{{/each}}
		{{/with}}
	{{/with}}
{{/with}}```


## Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.

Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR

CWE: CWE-501 (Trust Boundary Violation — hook-scoped mutation leaks to global default sets) via CWE-693 (Protection Mechanism Failure — the default allow-list is silently widened for all subsequent sanitize calls)

Summary

The data.allowedTags and data.allowedAttributes fields passed to uponSanitizeElement and uponSanitizeAttribute hooks are direct references to the library's live ALLOWED_TAGS / ALLOWED_ATTR sets. For sanitize calls that don't supply an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array, those live sets are themselves direct references to the module-level DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR constants. A hook that mutates these fields — a natural-looking pattern for "allow X for this iteration" — permanently writes new entries into the default constants for the DOMPurify instance's lifetime. Every subsequent sanitize call that doesn't override the config inherits the widened defaults, so an attacker payload that uses the poisoned tag/attribute name survives sanitization. removeAllHooks(), clearConfig(), and even passing a fresh cfg: {} do not recover; only constructing a new DOMPurify instance does.

The maintainer's existing defense at src/purify.ts:696-700 explicitly clones DEFAULT_ALLOWED_TAGS before mutating it via cfg.ADD_TAGS (array form), demonstrating awareness of this exact class. The hook path remained uncovered.

Affected

• DOMPurify ≤ 3.4.5, including main at 7996f1dc78eb8b7922388aed75d94a9f8fad9a36
• Any application that installs a hook on uponSanitizeElement or uponSanitizeAttribute that writes to data.allowedTags[...] = true or data.allowedAttributes[...] = true and later sanitizes attacker-influenced content with default config (no explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array)

Vulnerability details

[A] — data.allowedTags is a reference to ALLOWED_TAGS

src/purify.ts:1206-1209:

_executeHooks(hooks.uponSanitizeElement, currentNode, {
  tagName,
  allowedTags: ALLOWED_TAGS,         // [A] direct reference; hook mutation
                                      //     mutates the very ALLOWED_TAGS the
                                      //     library checks on the next element
});

src/purify.ts:1494-1500 (the matching attribute hook):

const hookEvent = {
  attrName: '',
  attrValue: '',
  keepAttr: true,
  allowedAttributes: ALLOWED_ATTR,    // [A'] same pattern
  forceKeepAttr: undefined,
};

[B] — ALLOWED_TAGS = DEFAULT_ALLOWED_TAGS for default-cfg sanitize calls

src/purify.ts:527-531:

ALLOWED_TAGS =
  objectHasOwnProperty(cfg, 'ALLOWED_TAGS') &&
  arrayIsArray(cfg.ALLOWED_TAGS)
    ? addToSet({}, cfg.ALLOWED_TAGS, transformCaseFunc)
    : DEFAULT_ALLOWED_TAGS;            // [B] reference assignment; ALLOWED_TAGS
                                       //     IS the DEFAULT_ALLOWED_TAGS object

(The ALLOWED_ATTR = DEFAULT_ALLOWED_ATTR path at :532-536 is symmetric.)

The mismatch

A hook author who writes data.allowedTags['script'] = true reasonably expects per-call scope — the API name is "data", suggesting per-event payload. But [A] makes this a direct reference, and [B] makes that reference equal to the module-level default for the common default-cfg path. The hook's mutation therefore writes to a constant that every subsequent default-cfg sanitize call rebinds to.

The maintainer already recognized this class for the ADD_TAGS array path — src/purify.ts:696-700:

} else if (arrayIsArray(cfg.ADD_TAGS)) {
  if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS) {
    ALLOWED_TAGS = clone(ALLOWED_TAGS);   // explicitly clone DEFAULT before
                                          // mutating to avoid this pollution
  }
  addToSet(ALLOWED_TAGS, cfg.ADD_TAGS, transformCaseFunc);
}

The same…

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Recommendation

For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or later.

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 1.3.0-tuxcare.1.

TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 1.0.12-tuxcare.2.

TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 2.5.8-tuxcare.4.

TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.3-tuxcare.2.

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 2.5.9-tuxcare.4.

TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.2.3-tuxcare.2.

TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.4.

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.3.0-tuxcare.1.

TuxCare rebuilt dompurify to address 16 CVEs. Fixed in 2.4.0-tuxcare.1.

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.4.3-tuxcare.1.

TuxCare rebuilt dompurify to address 14 CVEs. Fixed in 2.4.7-tuxcare.1.

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.3.

TuxCare rebuilt dompurify to address 34 CVEs. Fixed in 3.0.3-tuxcare.1.

TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.1.6-tuxcare.7.

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.3.0-tuxcare.5.

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.0-tuxcare.5.

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.3-tuxcare.5.

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.7-tuxcare.5.

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 2.4.3-tuxcare.8.

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.2.7-tuxcare.3.

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.0.8-tuxcare.3.

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 2.3.3-tuxcare.3.

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.3.3-tuxcare.3.

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.2.6-tuxcare.3.

TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 2.3.10-tuxcare.3.

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.1-tuxcare.3.

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.5-tuxcare.3.

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.2-tuxcare.3.

TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.0.8-tuxcare.3.

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.6-tuxcare.3.

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.0.9-tuxcare.3.

TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.0.11-tuxcare.3.

TuxCare rebuilt dompurify to address 6 CVEs. Fixed in 3.1.0-tuxcare.3.

TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.1.3-tuxcare.3.

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.1.2-tuxcare.3.

TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.1-tuxcare.3.

TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.1.4-tuxcare.3.

TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.4.0-tuxcare.1.

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.0.6-tuxcare.8.

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.0.4-tuxcare.5.

TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 3.0.5-tuxcare.5.

Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.

Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.