A code injection vulnerability in the Handlebars.js precompiler allows local attackers to execute arbitrary JavaScript code, posing a significant risk to build pipeline integrity.

The Handlebars CLI precompiler improperly handles user-controlled input, specifically template filenames and CLI options, by concatenating them directly into generated JavaScript without sanitization. This flaw requires low-privilege access to the build environment to trigger code execution.

The ability to inject arbitrary JavaScript into the build process can lead to full compromise of the generated application code. With a CVSS score of 8.2, this vulnerability represents a High risk, as it may allow attackers to inject malicious backdoors or exfiltrate sensitive data from downstream users of the compiled software. Organizations relying on automated build pipelines are particularly vulnerable to supply chain attacks.

Immediate Action: Update the Handlebars.js package to version 4.7.9 or later to resolve the underlying sanitization flaw.

Proactive Monitoring: Audit build logs for unusual CLI arguments or filename patterns that contain special characters such as quotes or semicolons.

Compensating Controls: Execute build processes within isolated, sandboxed containers that lack write access to sensitive system paths, and implement strict validation for all inputs passed to the precompiler.

Public Exploit Available: Unknown.

This vulnerability presents a serious risk to the integrity of software development life cycles. Security teams should prioritize updating Handlebars.js to version 4.7.9 immediately. If an update cannot be applied globally, implement the recommended sandboxing and input validation controls to contain the risk of code injection within your build infrastructure.