p PatchFirst

CVE-2021-23369

CVE-2021-23369 · Remote Code Execution (RCE)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVSS 5.6 · Medium · EPSS 7.0% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • handlebars

    Versions
    • ≥ unspecified, < 4.7.7: Affected (custom)

    Update to 4.7.7

  • node-handlebars Debian:12

    Affected ranges
    • ECOSYSTEM: < 3:4.7.6+~4.1.0-2

    Update to 3:4.7.6+~4.1.0-2

  • node-handlebars Debian:13

    Affected ranges
    • ECOSYSTEM: < 3:4.7.6+~4.1.0-2

    Update to 3:4.7.6+~4.1.0-2

  • node-handlebars Debian:14

    Affected ranges
    • ECOSYSTEM: < 3:4.7.6+~4.1.0-2

    Update to 3:4.7.6+~4.1.0-2

  • handlebars npm

    Affected ranges
    • SEMVER: < 4.7.7

    Update to 4.7.7

  • org.webjars:handlebars Maven

    Versions
    • 1.0.0
    • 1.0.0-rc.3
    • 1.0.0-rc.4
    • 1.0.rc.1
    • 1.1.2
    • 1.2.1
    • 1.3.0
    • 2.0.0
    • 2.0.0-1
    • 2.0.0-alpha.2
    • 3.0.0
    • 3.0.0-1
    • 3.0.3
    • 4.0.11
    • 4.0.11-1
    • 4.0.13
    • 4.0.14
    • 4.0.2
    • 4.0.5
    • 4.0.6
    • 4.7.6
    Affected ranges
    • ECOSYSTEM: < 4.7.7

    Update to 4.7.7

  • org.webjars.npm:handlebars Maven

    Versions
    • 1.3.0
    • 2.0.0
    • 3.0.0
    • 3.0.1
    • 3.0.3
    • 4.0.11
    • 4.0.12
    • 4.0.14
    • 4.0.2
    • 4.0.5
    • 4.0.6
    • 4.1.1
    • 4.1.2
    • 4.2.1
    • 4.3.1
    • 4.4.0
    • 4.4.5
    • 4.5.3
    • 4.7.2
    • 4.7.3
    • 4.7.6
    Affected ranges
    • ECOSYSTEM: < 4.7.7

    Update to 4.7.7

  • org.webjars.bowergithub.wycats:handlebars.js Maven

    Versions
    • 4.1.1
    • 4.2.0
    • 4.4.5
    • 4.5.3
    • 4.7.2
    Affected ranges
    • ECOSYSTEM: < 4.7.7

    Update to 4.7.7

  • node-handlebars Ubuntu:18.04:LTS

    Versions
    • 3:4.0.10-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:20.04:LTS

    Versions
    • 3:4.1.0-1
    • 3:4.5.3-1
    • 3:4.7.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:22.04:LTS

    Versions
    • 3:4.7.6+~4.1.0-2
    • 3:4.7.7+~4.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →