PT-2021-15466 · Unknown · Handlebars

Francois Lajeunesse-Robert · Published 2021-04-12 · Updated 2026-03-26 · CVE-2021-23369

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.7.7

Description The issue allows for Remote Code Execution (RCE) when certain compiling options are selected to compile templates from an untrusted source.

Recommendations For versions prior to 4.7.7, update to version 4.7.7 or later to resolve the issue.

Exploit

Fix

Code Injection

XSS

Prototype Pollution

Weakness Enumeration

CWE-94

CWE-79

CWE-1321

Related Identifiers

CVE-2021-23369

GHSA-2QVQ-RJWJ-GVW9

GHSA-F2JV-R9RF-7988

SNYK-JAVA-ORGWEBJARS-1074950

SNYK-JAVA-ORGWEBJARSBOWER-1074951

SNYK-JAVA-ORGWEBJARSNPM-1074952

SNYK-JS-HANDLEBARS-1056767

Affected Products

Handlebars

References · 24

• 🔥 https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 · Exploit
• https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8 · Patch
• https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 · Patch
• https://ubuntu.com/security/CVE-2021-23369 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2qvq-rjwj-gvw9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23383 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23369 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f2jv-r9rf-7988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23369 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-23369 · Security Note