GHSA-f2jv-r9rf-7988

Remote code execution in handlebars when compiling templates

En bref

Publiée: 2021-05-06 15:57 UTC
Mise à jour: 2026-09-10 03:49 UTC
CVE: CVE-2021-23369
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Paquets affectés

Paquet	Versions
npm · handlebars	introduced 0, fixed 4.7.7
Maven · org.webjars:handlebars	introduced 0, fixed 4.7.7
Maven · org.webjars.npm:handlebars	introduced 0, fixed 4.7.7
Maven · org.webjars.bowergithub.wycats:handlebars.js	introduced 0, fixed 4.7.7

Références

https://nvd.nist.gov/vuln/detail/CVE-2021-23369 ADVISORY
https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8 WEB
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 WEB
https://github.com/wycats/handlebars.js PACKAGE
https://security.netapp.com/advisory/ntap-20210604-0008 WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952 WEB
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database