Handlebars.js versions 4.0.0 through 4.7.8 contain a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in the CLI precompiler component. The precompiler concatenates user-controlled strings such as template filenames and CLI options directly into the generated JavaScript code without any escaping or sanitization. This flaw enables an attacker who can influence these inputs to inject arbitrary JavaScript code that executes in Node.js or browser environments when the compiled bundle is loaded. The vulnerability is fixed in version 4.7.9. Mitigations include input validation to reject characters significant in JavaScript strings, using fixed trusted namespace strings instead of CLI arguments, sandboxing the precompiler execution environment, and auditing template filenames in build pipelines.

Successful exploitation allows an attacker with the ability to control template filenames or CLI arguments to execute arbitrary JavaScript code in the context of the generated bundle. This can lead to full compromise of confidentiality, integrity, and availability of the affected system or application. The CVSS 3.1 score is 8.3 (High), reflecting local attack vector with low complexity, requiring low privileges and user interaction, and resulting in complete impact to confidentiality, integrity, and availability.

A fixed version 4.7.9 of handlebars.js is available and should be applied to remediate this vulnerability. Until upgrading, users should validate all CLI inputs to reject characters with JavaScript string-escaping significance (e.g., quotes, semicolons). Use fixed, trusted namespace strings via configuration files rather than command-line arguments in automated pipelines. Run the precompiler in sandboxed environments with restricted permissions to limit exploitation impact. Additionally, audit template filenames in any repositories or packages used in automated build pipelines to detect potentially malicious inputs.