{"id":"CVE-2021-23369","aliases":["CLSA-2026-1773101681","CLSA-2026-1774743817","CLSA-2026-1774743830","CLSA-2026-1774743837","CLSA-2026-1774743840","CLSA-2026-1776991069","CLSA-2026-1784596337","CLSA-2026-1786731948","CLSA-2026-1792421536","DEBIAN-CVE-2021-23369","EUVD-2021-1052","GHSA-2cf5-4w76-r9qv","GHSA-442j-39wm-28r2","GHSA-f2jv-r9rf-7988","GHSA-g9r4-xpmj-mj65","GHSA-q2c6-c6pm-g3gh","GHSA-q42p-pg8m-cqh6","ROOT-APP-NPM-CVE-2021-23369","ROOT-APP-NPM-GHSA-2cf5-4w76-r9qv","ROOT-APP-NPM-GHSA-g9r4-xpmj-mj65","ROOT-APP-NPM-GHSA-q2c6-c6pm-g3gh","ROOT-APP-NPM-GHSA-q42p-pg8m-cqh6","UBUNTU-CVE-2021-23369"],"status":"published","title":"Remote Code Execution (RCE)","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.07028,"percentile":0.94261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1321","CWE-367","CWE-471","CWE-94"],"published":"2019-06-05T14:07:48Z","modified":"2026-11-09T12:49:13Z","exploits":[{"source":"pocgithub","id":"fazilbaig1/CVE-2021-23369","title":"fazilbaig1/CVE-2021-23369","date":"2024-10-19","url":"https://github.com/fazilbaig1/CVE-2021-23369"},{"source":"pocgithub","id":"dinhvaren/cve-2021-23369","title":"dinhvaren/cve-2021-23369","date":"2026-03-28","url":"https://github.com/dinhvaren/cve-2021-23369"}],"fixes":[{"ecosystem":"npm","package":"handlebars","fixed_in":["3.0.8","4.5.2","4.7.9","4.7.7","4.5.3","4.1.2","4.0.14","3.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars:handlebars","fixed_in":["4.7.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.npm:handlebars","fixed_in":["4.7.7"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.webjars.bowergithub.wycats:handlebars.js","fixed_in":["4.7.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"handlebars","fixed_in":["1.3.0-tuxcare.1","1.0.12-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-handlebars","fixed_in":["3:4.7.6+~4.1.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-handlebars","fixed_in":["3:4.7.6+~4.1.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-handlebars","fixed_in":["3:4.7.6+~4.1.0-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"handlebars","fixed_in":["3.0.8-aikido.2","3.0.7-aikido.3","3.0.3-aikido.2","4.7.7-aikido.2","4.7.7-aikido.3","4.7.7-aikido.4","4.7.7-aikido.5","3.0.8-aikido.1","3.0.7-aikido.1","3.0.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/handlebars","fixed_in":["3.0.8-root.io.2","3.0.7-root.io.3","3.0.3-root.io.2","4.7.7-root.io.1","4.7.7-root.io.2","4.7.7-root.io.3","4.7.7-root.io.4","4.7.7-root.io.5","3.0.8-root.io.1","3.0.7-root.io.1","3.0.7-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.7.8"},{"fixed":"4.7.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars:handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.npm:handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.webjars.bowergithub.wycats:handlebars.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.1"}]}],"versions":["3.0.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-tuxcare.0"},{"fixed":"1.3.0-tuxcare.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.12-tuxcare.0"},{"fixed":"1.0.12-tuxcare.2"}]}],"versions":["1.0.12","1.0.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.3"}]}],"versions":["2.0.0","2.0.0-tuxcare.1","2.0.0-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-tuxcare.0"},{"fixed":"1.3.0-tuxcare.3"}]}],"versions":["1.3.0","1.3.0-tuxcare.1","1.3.0-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.9-tuxcare.0"},{"fixed":"4.7.9-tuxcare.1"}]}],"versions":["4.7.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-tuxcare.0"},{"fixed":"3.0.8-tuxcare.1"}]}],"versions":["3.0.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.3-tuxcare.0"},{"fixed":"4.5.3-tuxcare.4"}]}],"versions":["4.5.3","4.5.3-tuxcare.1","4.5.3-tuxcare.2","4.5.3-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.7.6+~4.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.7.6+~4.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.7.6+~4.1.0-2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.7.9"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.webjars:handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}],"versions":["1.0.0","1.0.0-rc.3","1.0.0-rc.4","1.0.rc.1","1.1.2","1.2.1","1.3.0","2.0.0","2.0.0-1","2.0.0-alpha.2","3.0.0","3.0.0-1","3.0.3","4.0.11","4.0.11-1","4.0.13","4.0.14","4.0.2","4.0.5","4.0.6","4.7.6"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.npm:handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}],"versions":["1.3.0","2.0.0","3.0.0","3.0.1","3.0.3","4.0.11","4.0.12","4.0.14","4.0.2","4.0.5","4.0.6","4.1.1","4.1.2","4.2.1","4.3.1","4.4.0","4.4.5","4.5.3","4.7.2","4.7.3","4.7.6"]},{"source":"osv","ecosystem":"Maven","package":"org.webjars.bowergithub.wycats:handlebars.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.7"}]}],"versions":["4.1.1","4.2.0","4.4.5","4.5.3","4.7.2"]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.14"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-aikido.2"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"4.7.7-aikido.2"},{"fixed":"4.7.7-aikido.3"},{"fixed":"4.7.7-aikido.4"},{"fixed":"4.7.7-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-root.io.2"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"4.7.7-root.io.1"},{"fixed":"4.7.7-root.io.2"},{"fixed":"4.7.7-root.io.3"},{"fixed":"4.7.7-root.io.4"},{"fixed":"4.7.7-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.7-aikido.1"},{"fixed":"3.0.7-aikido.2"},{"fixed":"3.0.7-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.7-root.io.1"},{"fixed":"3.0.7-root.io.2"},{"fixed":"3.0.7-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.0.10-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.1.0-1","3:4.5.3-1","3:4.7.2-1"]}],"products":[{"vendor":"handlebarsjs","product":"handlebars"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20210604-0008/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.npmjs.com/advisories/1316","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2cf5-4w76-r9qv"},{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-442j-39wm-28r2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23369","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f2jv-r9rf-7988"},{"url":"https://www.npmjs.com/advisories/1325","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g9r4-xpmj-mj65"},{"url":"https://www.npmjs.com/advisories/1324","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q2c6-c6pm-g3gh"},{"url":"https://github.com/handlebars-lang/handlebars.js/issues/1495","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/7372d4e9dffc9d70c09671aa28b9392a1577fd86","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692","tags":["web"]},{"url":"https://www.npmjs.com/advisories/755","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/0d6d8c335ad81bad1b672fc56b6a44f6aa472dac","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/85c8783b34fc6d36145d8b53885ad0b9e3c3f9c4","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/cd38583216dce3252831916323202749431c773e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q42p-pg8m-cqh6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23369","tags":["advisory"]},{"url":"https://github.com/handlebars-lang/handlebars.js","tags":["package"]},{"url":"https://github.com/wycats/handlebars.js","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210604-0008","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-23369","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23369","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-23369","title":"Remote Code Execution (RCE)","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-04-12T13:10:28.403Z","modified":"2026-10-08T21:13:45.623Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-1052","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-04-12T13:10:28Z","modified":"2026-10-08T21:13:45Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-02T17:27:26.856493Z"}],"ghsa":[{"id":"GHSA-2cf5-4w76-r9qv","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert('Vulnerable Handlebars JS');\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.","status":"published","published":"2020-09-04T14:57:38Z","modified":"2024-02-07T05:08:28Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:36.076201Z"},{"id":"GHSA-442j-39wm-28r2","title":"Handlebars.js has a Property Access Validation Bypass in container.lookup","description":"## Summary\n\nIn `lib/handlebars/runtime.js`, the `container.lookup()` function uses `container.lookupProperty()` as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (`depths[i][name]`). This Time-of-Check Time-of-Use (TOCTOU) pattern means the security check and the actual read are decoupled, and the raw access bypasses any sanitization that `lookupProperty` may perform.\n\nOnly relevant when the **compat** compile option is enabled (`{compat: true}`), which activates `depthedLookup` in `lib/handlebars/compiler/javascript-compiler.js`.\n\n## Description\n\nThe vulnerable code in `lib/handlebars/runtime.js` (lines 137–144):\n\n```javascript\nlookup: function (depths, name) {\n  const len = depths.length;\n  for (let i = 0; i \u003c len; i++) {\n    let result = depths[i] \u0026\u0026 container.lookupProperty(depths[i], name);\n    if (result != null) {\n      return depths[i][name];  // BUG: should be `return result;`\n    }\n  }\n},\n```\n\n`container.lookupProperty()` (lines 119–136) enforces `hasOwnProperty` checks and `resultIsAllowed()` prototype-access controls. However, `container.lookup()` only uses `lookupProperty` as a boolean gate — if the gate passes (`result != null`), it then performs an independent, raw `depths[i][name]` access that circumvents any transformation or wrapped value that `lookupProperty` may have returned.\n\n## Workarounds\n\n- Avoid enabling `{ compat: true }` when rendering templates that include untrusted data.\n- Ensure context data objects are plain JSON (no Proxies, no getter-based accessor properties).","status":"published","published":"2026-03-29T15:16:37Z","modified":"2026-03-29T15:16:37Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:39:44.97342Z"},{"id":"GHSA-f2jv-r9rf-7988","title":"Remote code execution in handlebars when compiling templates","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-05-06T15:57:44Z","modified":"2023-11-29T20:35:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:22.840002Z"},{"id":"GHSA-q42p-pg8m-cqh6","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.\n\n\n## Recommendation\n\nFor handlebars 4.1.x upgrade to 4.1.2 or later.\nFor handlebars 4.0.x upgrade to 4.0.14 or later.","status":"published","published":"2019-06-05T14:07:48Z","modified":"2023-11-29T20:32:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T14:37:22.840002Z"},{"id":"GHSA-g9r4-xpmj-mj65","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:06:32Z","modified":"2023-01-09T05:04:02Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:08.267721Z"},{"id":"GHSA-q2c6-c6pm-g3gh","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:07:38Z","modified":"2023-01-09T05:04:24Z","updated_at":"2026-11-02T14:36:09.554044Z"}],"nvd":[{"id":"CVE-2021-23369","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-04-12T14:15:14.383Z","modified":"2026-10-08T22:17:07.613Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"CVE-2021-23369","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-04-12T14:15:14.383Z","modified":"2026-10-20T10:54:31.889996589Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-23369","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-04-12T14:15:14.383Z","modified":"2026-10-09T09:47:35.275614199Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-2cf5-4w76-r9qv","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert('Vulnerable Handlebars JS');\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.","status":"published","published":"2020-09-04T14:57:38Z","modified":"2026-09-10T03:48:33.174881747Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"GHSA-442j-39wm-28r2","title":"Handlebars.js has a Property Access Validation Bypass in container.lookup","description":"## Summary\n\nIn `lib/handlebars/runtime.js`, the `container.lookup()` function uses `container.lookupProperty()` as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (`depths[i][name]`). This Time-of-Check Time-of-Use (TOCTOU) pattern means the security check and the actual read are decoupled, and the raw access bypasses any sanitization that `lookupProperty` may perform.\n\nOnly relevant when the **compat** compile option is enabled (`{compat: true}`), which activates `depthedLookup` in `lib/handlebars/compiler/javascript-compiler.js`.\n\n## Description\n\nThe vulnerable code in `lib/handlebars/runtime.js` (lines 137–144):\n\n```javascript\nlookup: function (depths, name) {\n  const len = depths.length;\n  for (let i = 0; i \u003c len; i++) {\n    let result = depths[i] \u0026\u0026 container.lookupProperty(depths[i], name);\n    if (result != null) {\n      return depths[i][name];  // BUG: should be `return result;`\n    }\n  }\n},\n```\n\n`container.lookupProperty()` (lines 119–136) enforces `hasOwnProperty` checks and `resultIsAllowed()` prototype-access controls. However, `container.lookup()` only uses `lookupProperty` as a boolean gate — if the gate passes (`result != null`), it then performs an independent, raw `depths[i][name]` access that circumvents any transformation or wrapped value that `lookupProperty` may have returned.\n\n## Workarounds\n\n- Avoid enabling `{ compat: true }` when rendering templates that include untrusted data.\n- Ensure context data objects are plain JSON (no Proxies, no getter-based accessor properties).","status":"published","published":"2026-03-29T15:16:37Z","modified":"2026-09-10T03:50:36.874716263Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"GHSA-f2jv-r9rf-7988","title":"Remote code execution in handlebars when compiling templates","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-05-06T15:57:44Z","modified":"2026-09-10T03:49:14.82972736Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"GHSA-q42p-pg8m-cqh6","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.\n\n\n## Recommendation\n\nFor handlebars 4.1.x upgrade to 4.1.2 or later.\nFor handlebars 4.0.x upgrade to 4.0.14 or later.","status":"published","published":"2019-06-05T14:07:48Z","modified":"2026-09-10T03:48:23.648231681Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2021-23369","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","status":"published","published":"2021-04-12T14:15:00Z","modified":"2026-11-09T12:49:13.600762809Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"CLSA-2026-1773101681","title":"TuxCare security update for handlebars (9 CVEs)","description":"TuxCare rebuilt handlebars to address 9 CVEs. Fixed in 3.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:26.324830766Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1774743817","title":"TuxCare security update for handlebars (1 CVE)","description":"TuxCare rebuilt handlebars to address 1 CVE. Fixed in 1.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.668758728Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743830","title":"TuxCare security update for handlebars (3 CVEs)","description":"TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 1.0.12-tuxcare.2.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-23T19:28:13.663406058Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743837","title":"TuxCare security update for handlebars (7 CVEs)","description":"TuxCare rebuilt handlebars to address 7 CVEs. Fixed in 2.0.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.473951217Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743840","title":"TuxCare security update for handlebars (6 CVEs)","description":"TuxCare rebuilt handlebars to address 6 CVEs. Fixed in 1.3.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.721630553Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776991069","title":"TuxCare security update for handlebars (9 CVEs)","description":"TuxCare rebuilt handlebars to address 9 CVEs. Fixed in 4.7.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:47:50.026036318Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1784596337","title":"TuxCare security update for handlebars (3 CVEs)","description":"TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 3.0.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:36.233368352Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1786731948","title":"TuxCare security update for dompurify (34 CVEs)","description":"TuxCare rebuilt dompurify to address 34 CVEs. Fixed in 3.0.3-tuxcare.1.","status":"withdrawn","published":"2026-08-14T18:25:48Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792421536","title":"TuxCare security update for handlebars (2 CVEs)","description":"TuxCare rebuilt handlebars to address 2 CVEs. Fixed in 4.5.3-tuxcare.4.","status":"published","published":"2026-10-19T14:52:16Z","modified":"2026-10-19T19:15:11.429100758Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"GHSA-g9r4-xpmj-mj65","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:06:32Z","modified":"2026-09-10T03:49:13.649783342Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GHSA-q2c6-c6pm-g3gh","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:07:38Z","modified":"2026-09-10T03:48:58.277710865Z","updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"ROOT-APP-NPM-CVE-2021-23369","title":"CVE-2021-23369 in handlebars - Patched by Root","description":"Root has patched CVE-2021-23369 in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:39.381954217Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-2cf5-4w76-r9qv","title":"GHSA-2cf5-4w76-r9qv in handlebars - Patched by Root","description":"Root has patched GHSA-2cf5-4w76-r9qv in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:38.540557189Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-g9r4-xpmj-mj65","title":"GHSA-g9r4-xpmj-mj65 in handlebars - Patched by Root","description":"Root has patched GHSA-g9r4-xpmj-mj65 in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:39.391242933Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-q2c6-c6pm-g3gh","title":"GHSA-q2c6-c6pm-g3gh in handlebars - Patched by Root","description":"Root has patched GHSA-q2c6-c6pm-g3gh in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:37.928892011Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-q42p-pg8m-cqh6","title":"GHSA-q42p-pg8m-cqh6 in handlebars - Patched by Root","description":"Root has patched GHSA-q42p-pg8m-cqh6 in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:37.540463486Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}