PT-2020-10875 · Handlebars · Handlebars

Francois Lajeunesse-Robert · Published 2020-09-30 · Updated 2022-02-10 · CVE-2019-20920

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Handlebars versions prior to 3.0.8 Handlebars versions 4.x prior to 4.5.3

Description The issue allows attackers to execute arbitrary JavaScript code by submitting templates that are not properly validated by the lookup helper. This can lead to arbitrary code execution on a server that processes Handlebars templates or in a victim's browser, effectively serving as a cross-site scripting (XSS) attack.

Recommendations For Handlebars versions prior to 3.0.8, update to version 3.0.8 or later. For Handlebars versions 4.x prior to 4.5.3, update to version 4.5.3 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-20920

GHSA-3CQR-58RM-57F8

RHSA-2020:5179

SNYK-JS-HANDLEBARS-534478

Affected Products

Handlebars

References · 14

• 🔥 https://npmjs.com/advisories/1316 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-20920 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20920 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3cqr-58rm-57f8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-20920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20920 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20920 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20920 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20920 · Vendor Advisory
• https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee · Note
• https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e · Note
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478 · Note
• https://npmjs.com/advisories/1324 · Note
• https://npmjs.com/package/handlebars · Note