Critical severity · published Apr 12, 2021
CVE-2021-23369
Remote Code Execution (RCE)
9.8
CVSS
7%
EPSS
No
On KEV
Description
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.0% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
handlebars ·
before 4.7.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23369
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23369
Patch
https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
Patch
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210604-0008/
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952
More from handlebars
9.8
CVE-2021-23383
Prototype Pollution