[Security] Code Injection via Unescaped Custom Delimiters in Compiler (CWE-94)

[ByamB4]

Hi,

I found a code injection vulnerability in hogan.js that allows arbitrary code execution when compiling templates with crafted custom delimiters.

Affected: hogan.js <= 3.0.2 (all versions)
Severity: HIGH 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CWE: CWE-94 (Improper Control of Generation of Code)

Root Cause: The esc() function in lib/compiler.js is applied to variable names (esc(node.n)), partial names (esc(sym)), and text (esc(node.text)) to prevent string-literal breakout in generated code. However, custom delimiters (node.otag, node.ctag) are embedded raw at line 332:

// Line 332 - NOT escaped
',"' + node.otag + " " + node.ctag + '")){' +

Custom delimiters can be set inline via standard Mustache {{=OTAG CTAG=}} syntax. A ctag containing " breaks out of the string literal, injecting arbitrary JS into the new Function() call at line 293.

Fix: Apply esc() to delimiter values:

',"' + esc(node.otag) + " " + esc(node.ctag) + '")){' +

I have a full PoC available. Since private vulnerability reporting is not enabled on this repo, I'm filing this as an issue. I would appreciate a GitHub Security Advisory for CVE tracking.

Researcher: Byambadalai Sumiya
GitHub: @ByamB4

[jgonggrijp]

@ByamB4 please don't do immediate public reports like this. If all else fails, you can still find an email address through git log. Also please observe that hogan.js is end of life and that it has a maintained fork by ProfoundLogic.