CVE-2015-8861: handlebars.js_project handlebars.js Cross-site Scripting
CVSS: 6.1v3.1MediumModified
AliasesUBUNTU-CVE-2015-8861DEBIAN-CVE-2015-8861CGA-75xr-8cm8-mmcqCGA-8h5g-3hmg-r5q9CGA-jcc7-7cp6-32pmCGA-xrch-xf9h-rwq4GHSA-9prh-257w-9277CGA-2294-vjx7-4pmqCGA-25rw-fpr8-wc9hCGA-2757-6hrv-qf42CGA-28w5-7rqr-wj8rCGA-2h48-7mhg-3hcxCGA-2j6j-pxfm-wmjwCGA-2r4x-6662-frwxCGA-2wg7-3wx9-2hx9CGA-3669-8rcx-3x49CGA-377f-x688-hm39CGA-377m-2gw7-792xCGA-387g-77v3-687wCGA-3gc2-993m-fhr3CGA-3q5q-45jq-rrmpCGA-3xh6-g96h-ghw2CGA-48gm-vcjr-hp3pCGA-4hxv-hgv4-wx48CGA-4rfc-r3wx-52r2CGA-4whm-w5f2-vhxxCGA-52rr-24g7-f4qcCGA-53c2-ggvq-mc32CGA-5mhg-4g2m-r97cCGA-5v22-p5vg-8jwhCGA-634g-9vhg-hq48CGA-63c4-8grp-hrhpCGA-63v6-3582-m796CGA-66pc-xjvc-j4qwCGA-66x5-p85r-7v7wCGA-68wp-ppvg-96hqCGA-6ch5-hvp9-28vgCGA-6fj8-5x8j-82wgCGA-6fmf-9p82-2w6pCGA-6gh2-fp2v-x93jCGA-6j8g-gw4g-95pfCGA-6p23-jx3g-mq3fCGA-6pm3-4m86-w37hCGA-6q4q-427g-2r3fCGA-6rf8-8pg3-6wg2CGA-6vm8-67v8-c8cxCGA-6x7g-8x24-j6hrCGA-6x89-x4g2-rcjhCGA-6x8x-qwh3-9m9fCGA-73x4-7j79-wg72CGA-7428-x5q8-5fwvCGA-74jf-47qr-hf8wCGA-7f6h-cm87-q2x4CGA-7g74-jr6r-x2x8CGA-7j6p-x5q2-m7j5CGA-7mxc-jmcm-3c3rCGA-7p8c-4fpw-vcvhCGA-7qfr-j368-pjccCGA-7rv6-49f8-895jCGA-7xj4-m253-3x82CGA-847q-7fc5-9g78CGA-849c-jrj2-qp4hCGA-85g9-26gf-rvxfCGA-87xx-r5m3-878mCGA-885j-4h66-vhg2CGA-88qp-xwj9-wh9jCGA-88x7-32q2-jgf7CGA-8g34-x7fh-g762CGA-8jjc-vjcw-78xgCGA-8p9j-8xh9-r3f7CGA-8rrh-5887-7crjCGA-8w4h-mpvm-xc5fCGA-93ph-gvq9-7qf4CGA-97fc-34ff-hrprCGA-982x-mvr3-qcrgCGA-98w5-j7gv-2p62CGA-9crf-rg7g-4pvcCGA-9ffj-xh6v-6h8vCGA-9hw5-4g53-95w2CGA-9vqh-h2f2-r52jCGA-c4qh-8vrp-px2hCGA-c56j-mrgg-9v2vCGA-c6h8-xxp3-j7grCGA-cp3r-qx8r-hcxcCGA-cq6j-cf7q-w67cCGA-cq79-44w6-r8rhCGA-cx5q-2754-62f7CGA-f344-2569-48xwCGA-f782-g67m-r69mCGA-f7wm-3cqw-748hCGA-fhrh-r26h-27p8CGA-fmrp-7j8g-vrqfCGA-fqr2-mp63-9r58CGA-frp5-95gw-66r7CGA-g8x6-4g5v-whqpCGA-gvq6-2p3w-xrjgCGA-h2gf-6qp3-qhpgCGA-h3h4-6jw5-xmx3CGA-h9xf-wr6g-p4cgCGA-hgrr-67c7-2vr5CGA-hj2m-7rh9-v7cfCGA-hq43-c2p4-fp9rCGA-hr7q-g8c8-grjmCGA-hvrp-prfr-jwf6CGA-hxcm-5wfr-j3g2CGA-j34c-wp2c-rm85CGA-j569-8w5c-53ffCGA-j84c-m28q-w6h8CGA-jc3w-85rm-98qjCGA-jfrv-r3h7-qvr2CGA-jqf8-5gp4-xvvxCGA-jqpv-h7qh-vw7cCGA-jrqf-7mwx-2p7vCGA-jvg7-hcqv-96j3CGA-m9j7-jx7q-xmfhCGA-mj33-5fgr-4f9jCGA-mrp9-5rrm-c728CGA-mrxh-2m44-2w4vCGA-p4qq-rrw3-vr7qCGA-p894-hh37-jj7mCGA-p9g5-3c2p-43r4CGA-r8fv-h5xf-83mrCGA-rg3w-gmq4-6xwpCGA-vccv-f9hr-3p7vCGA-vg6v-7pfp-gm6qCGA-px37-mg33-m5rxCGA-px5x-qxp8-gjc5CGA-pxw8-w4gj-fxvjCGA-q32w-vqfp-r6whCGA-q484-h937-fp6vCGA-qcj9-cj5f-wmxvCGA-qcx7-485h-hq4rCGA-qg45-jmvj-6xj2CGA-qxg4-79j3-8w2xCGA-r369-29gr-hm3pCGA-r38g-4xwc-9h6pCGA-r68c-4r4f-xv8xCGA-rfm8-wwjv-p57gCGA-rhv2-8j29-vxrjCGA-rqgr-hr48-6xvqCGA-v3q5-v7rw-35w9CGA-v5f9-rpfx-5hg2CGA-v5w5-48v8-2rwjCGA-vgxf-f3wf-654gCGA-vmqp-v47f-47f6CGA-vrxj-cjf9-8gvmCGA-w2rg-9cwm-3pf6CGA-w5v4-9wr9-pccwCGA-w645-2x2c-cqx5CGA-w9wh-hx2p-q7pwCGA-x544-qqhj-35vfCGA-x79p-gc29-rvmvCGA-x8w6-9jmj-vc7cCGA-xf7f-6v5p-5rcqCGA-xgvq-8w4f-g7j9CGA-cfx3-g835-9pxcCGA-c8pv-wr8q-r3mg
Published 23-01-2017Last modified 06-08-2024
Vulnerability summary
CVE-2015-8861 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in handlebars.js_project handlebars.js. EPSS estimates a 2.61% chance of exploitation in the next 30 days, higher than 85.1% of scored vulnerabilities.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
2.61%
0%100%
Low · -0.39 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 9Timeline
- 23-01-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
CVSS metrics
8 scores · 6 sources · 3 versionsMedium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Medium 6.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesSingle source
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.61%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
-0.39 pp
From 3.00% on 19-09-2026
19-09-202619-10-2026
EPSS score2.61%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard71 products
- code-serverAll versions (No fix recorded)
- code-server-compatAll versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.2All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.3All versions (No fix recorded)
Wolfi2 products
- code-serverAll versions (No fix recorded)
- code-server-compatAll versions (No fix recorded)
Debian1 product
- mustache.jsAll versions (No fix recorded)
Handlebars.js_project1 product
- handlebars.js< 4.0.0
Npm1 product
- handlebars< 4.0.0
Ubuntu1 product
- node-handlebars< 3:4.0.10-5
6 vendors · 77 products
References
14 links- www.sourceclear.com/blog/handlebars_vulnerability_research_findings/X Refsource MISCPatchThird Party AdvisoryAdvisoryFIX
- www.openwall.com/lists/oss-security/2016/04/20/11Mailing ListX Refsource MLISTThird Party AdvisoryAdvisoryARTICLEWEB
