CVE-2021-23383
criticalThe package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untruste…
Vendor / product: Handlebarsjs — handlebars
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2021-05-04 09:15
Modified: 2026-10-08 22:17
NVD status: Modified
Last synced 3 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
handlebarsjs / handlebars <4.7.7
netapp / e-series_performance_analyzer all versions
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030
Patch / mitigation: https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
Patch / mitigation: https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032
Patch / mitigation: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030
Patch / mitigation: https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
References
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1... report@snyk.io
- https://security.netapp.com/advisory/ntap-20210618-0007/ report@snyk.io
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 report@snyk.io
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 report@snyk.io
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 report@snyk.io
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 report@snyk.io
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1... af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20210618-0007/ af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 af854a3a-2127-422b-91ae-364da2661108
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗