CVE-2021-23369
criticalThe package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an…
Vendor / product: Handlebarsjs — handlebars
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2021-04-12 14:15
Modified: 2026-10-08 22:17
NVD status: Modified
Last synced 3 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
handlebarsjs / handlebars <4.7.7
Weakness classification (CWE)
NVD-CWE-noinfo
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
Patch / mitigation: https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
References
- https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608... report@snyk.io
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1... report@snyk.io
- https://security.netapp.com/advisory/ntap-20210604-0008/ report@snyk.io
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 report@snyk.io
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 report@snyk.io
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952 report@snyk.io
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767 report@snyk.io
- https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608... af854a3a-2127-422b-91ae-364da2661108
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1... af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20210604-0008/ af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952 af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗