CVE-2019-20920
At a glance
- Source
- NVD
- EPSS
- EPSS 3.15 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Weaknesses (CWE)
- CWE-94 — Improper Control of Generation of Code
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-3cqr-58rm-57f8 — Arbitrary Code Execution in Handlebars
European references
- ENISA EUVD · EUVD-2022-0789
- GCVE · GCVE-0-2019-20920
CERT-FR advisories
- CERTFR-2022-AVI-278 — Multiples vulnérabilités dans IBM Spectrum discover · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*< 3.0.8cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*≥ 4.0.0 < 4.5.3
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |