---
title: Handlebars – XSS Vulnerability On Versions Under 4.0.0
description: "**Impact area** Security **Severity** High **Affected element** **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-HANDLEBARS-LESSTHAN-V400 **(for ServiceNow) **SF-JSL-HANDLEBARS-LESSTHAN-V400 **(for Salesforce) ## Impact When using attributes without quotes in a handlebars template, an attacker can manipulate the input to introduce additional…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/vulnerabilities-in-open-source-libraries-salesforce/handlebars-xss-vulnerability-on-versions-under-4-0-0-2/"
updated: "2025-03-21"
category: Rules
---

# Handlebars – XSS Vulnerability On Versions Under 4.0.0

**Impact area**

Security

**Severity**

High

**Affected element**

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-HANDLEBARS-LESSTHAN-V400 **(for ServiceNow)

**SF-JSL-HANDLEBARS-LESSTHAN-V400 **(for Salesforce)

## Impact

When using attributes without quotes in a handlebars template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the handlebars template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

Remediation

Update the Handlebars JS library to the latest version.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html).