---
title: Handlebars – Prototype Pollution Vulnerability On Versions Greater Than Or Equal To 4.0.0 And Less Than 4.0.14
description: "**Impact area** Security **Severity** High **Affected element** **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-HANDLEBARS-BETWEEN-V307-V4014 **(for ServiceNow) **SF-JSL-HANDLEBARS-BETWEEN-V307-V4014 **(for Salesforce) ## Impact This vulnerability is due to an incomplete fix for: Prototype Pollution refers to the ability to inject properties…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/handlebars-prototype-pollution-vulnerability-on-versions-greater-than-or-equal-to-4-0-0-and-less-than-4-0-14-2/"
updated: "2025-03-21"
category: Rules
---

# Handlebars – Prototype Pollution Vulnerability On Versions Greater Than Or Equal To 4.0.0 And Less Than 4.0.14

**Impact area**

Security

**Severity**

High

**Affected element**

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-HANDLEBARS-BETWEEN-V307-V4014 **(for ServiceNow)

**SF-JSL-HANDLEBARS-BETWEEN-V307-V4014 **(for Salesforce)

## Impact

This vulnerability is due to an incomplete fix for: Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

Remediation

Update the Handlebars JS library to version 3.0.7, 4.1.2, 4.0.14 or higher.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html).