Handlebars.js versions 4.0.0 to 4.7.8 contain a vulnerability in the resolvePartial() function where partial names are resolved via a direct property lookup on options.partials without guarding against prototype pollution. This allows an attacker to inject a string into Object.prototype that matches a partial reference in a template, causing the injected string to be rendered without HTML escaping. This results in reflected or stored cross-site scripting (CWE-79). The vulnerability is fixed in version 4.7.9. Mitigations include applying Object.freeze(Object.prototype) early in application startup to prevent prototype pollution or using the runtime-only build of Handlebars which does not compile templates and reduces the attack surface.

An attacker who can pollute Object.prototype with a string matching a partial reference can cause arbitrary HTML/JavaScript to be rendered in the context of the application, leading to reflected or stored cross-site scripting. This can result in limited confidentiality and integrity impact (as per CVSS: partial data disclosure and modification). There is no impact on availability. The vulnerability requires user interaction and has a high attack complexity.

A fixed version, 4.7.9, is available and should be applied to remediate this vulnerability. As workarounds, applications can apply Object.freeze(Object.prototype) early during startup to prevent prototype pollution, though this may break other libraries. Alternatively, using the Handlebars runtime-only build (handlebars/runtime), which does not compile templates, can reduce the attack surface. Patch status is confirmed fixed in version 4.7.9.