Recommended action

Update com.github.jknack:handlebars to 4.5.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

handlebars.java FileTemplateLoader Path Traversal affects com.github.jknack:handlebars (maven). Severity is high. ### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources. ### Patches com.github.jknack:handlebars:4.5.2 ### Workarounds Validate template name is derived from user input. ```java if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) { throw new IOException("Path traversal attempt detected: " + location); } ```

AI coding agents often install or upgrade packages automatically in maven. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update com.github.jknack:handlebars to 4.5.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

handlebars.java FileTemplateLoader Path Traversal affects com.github.jknack:handlebars (maven). Severity is high. ### Impact Any application that passes user-controlled input to Handlebars.compile() using a FileTemplateLoader (or ClassPathTemplateLoader) is vulnerable to arbitrary file read. This is a realistic attack surface for web applications that use template names from URL path parameters, request parameters, or other user-controlled sources. ### Patches com.github.jknack:handlebars:4.5.2 ### Workarounds Validate template name is derived from user input. ```java if (!file.getPath().startsWith(new File(prefix).getCanonicalPath())) { throw new IOException("Path traversal attempt detected: " + location); } ```

AI coding agents often install or upgrade packages automatically in maven. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software