CVE-2016-3942: Template Injection in jsrender
Summary
CVE-2016-3942: Template Injection in jsrender. Affects jsrender versions < 0.9.74. Fixed in 0.9.74. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
jsrender is an npm package used for server-delivered client-side templates. It allows developers to dynamically embed user input into templates. However, versions of jsrender prior to 0.9.74 are vulnerable to a template injection vulnerability that can lead to remote code execution.
Vulnerability Detail
The vulnerability in jsrender arises when user input is not properly sanitized before being embedded into templates. An attacker can exploit this by injecting malicious code into the template, which is then executed on the server-side. This can result in remote code execution and potential compromise of the server. The Proof of Concept provided demonstrates how an attacker can exploit the vulnerability.
How To Fix
Latest published version: 1.2.0 as of 23 Oct 2026
npm install jsrender@1.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.74
This is the first release that contains the fix.
npm install jsrender@0.9.74Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the latest version of jsrender is the best solution.
Conclusion
The template injection vulnerability in jsrender can have serious security implications, potentially leading to remote code execution. It is crucial to update to the latest version of jsrender (0.9.74 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jsrender →
FAQ
jsrender is an npm package used for server-delivered client-side templates. It allows developers to create dynamic templates that can be rendered on the client-side.
Template injection is a vulnerability that occurs when user input is not properly sanitized and is directly embedded into templates. This can allow an attacker to inject malicious code into the template, leading to potential remote code execution.
The template injection vulnerability in jsrender can lead to remote code execution on the server-side. This can allow an attacker to execute arbitrary code and potentially compromise the server.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 6.3, indicating a moderate severity.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
