CVE-2021-23369medium

CVE-2021-23369: medium-severity vulnerability in handlebars

Remote Code Execution (RCE)

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.6epss 7.0%
exploitation probability
7.0%top 6% of all CVEs
observed exploitation
nono source reports it
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Affected products
n/a · handlebars
References
https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427https://security.netapp.com/advisory/ntap-20210604-0008/https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767