CVE-2021-23383
CVE-2021-23383 · Prototype Pollution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS 5.6 · Medium · EPSS 4.5% · Fix available
- Published
- Updated
Affected products and versions
handlebars
- Versions
- ≥ unspecified, < 4.7.7: Affected (custom)
Update to 4.7.7
node-handlebars Debian:12
- Affected ranges
- ECOSYSTEM: < 3:4.7.6+~4.1.0-2
Update to 3:4.7.6+~4.1.0-2
node-handlebars Debian:13
- Affected ranges
- ECOSYSTEM: < 3:4.7.6+~4.1.0-2
Update to 3:4.7.6+~4.1.0-2
node-handlebars Debian:14
- Affected ranges
- ECOSYSTEM: < 3:4.7.6+~4.1.0-2
Update to 3:4.7.6+~4.1.0-2
handlebars npm
- Affected ranges
- SEMVER: < 4.7.7
Update to 4.7.7
node-handlebars Ubuntu:18.04:LTS
- Versions
- 3:4.0.10-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-handlebars Ubuntu:20.04:LTS
- Versions
- 3:4.1.0-1
- 3:4.5.3-1
- 3:4.7.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-handlebars Ubuntu:22.04:LTS
- Versions
- 3:4.7.6+~4.1.0-2
- 3:4.7.7+~4.1.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-handlebars Ubuntu:24.04:LTS
- Versions
- 3:4.7.7+~4.1.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-handlebars Ubuntu:25.10
- Versions
- 3:4.7.7+~4.1.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-handlebars Ubuntu:26.10
- Versions
- 3:4.7.7+~4.1.0-1
- 3:4.7.9-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-handlebars Ubuntu:26.04:LTS
- Versions
- 3:4.7.7+~4.1.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032
- https://security.netapp.com/advisory/ntap-20210618-0007/
- https://nvd.nist.gov/vuln/detail/CVE-2021-23383