CVE-2021-23383 — Prototype Pollution in Handlebars

CWE-1321 — Prototype PollutionCWE-94 — Code Injection8 documents7 sources
Severity
9.8CRITICALNVD
CNA5.6
EPSS
3.2%
top 13.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Handlebarsjs Handlebars
Timeline
PublishedMay 4
Latest updateFeb 10

Description

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5handlebarsjs/handlebarsunspecified — 4.7.7

Patches

Patch: github.com ↗Patch: snyk.io ↗Patch: snyk.io ↗

🔴Vulnerability Details

4
GHSA
Prototype Pollution in handlebars↗2022-02-10
▶
OSV
Prototype Pollution in handlebars↗2022-02-10
▶
CVEList
Prototype Pollution↗2021-05-04
▶
OSV
CVE-2021-23383: The package handlebars before 4↗2021-05-04
▶

📋Vendor Advisories

2
Red Hat
nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option↗2021-04-12
▶
Debian
CVE-2021-23383: node-handlebars - The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when s...↗2021
▶
CVE-2021-23383 — Prototype Pollution in Handlebars | cvebase