GitHub Advisoryadvisory · npm, Maven

GHSA-f2jv-r9rf-7988 Remote code execution in handlebars when compiling templates

CRITICAL Published 2021-05-06 Modified 2022-10-04 Official page ↗
Aliases
CVE-2021-23369
Ecosystem
npm, Maven
Packages
handlebars, org.webjars:handlebars, org.webjars.npm:handlebars, org.webjars.bowergithub.wycats:handlebars.js
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2021-04-13

Affected packages

• npm handlebars: < 4.7.7 → fixed in 4.7.7 • Maven org.webjars:handlebars: < 4.7.7 → fixed in 4.7.7 • Maven org.webjars.npm:handlebars: < 4.7.7 → fixed in 4.7.7 • Maven org.webjars.bowergithub.wycats:handlebars.js: < 4.7.7 → fixed in 4.7.7

Description

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Related

Alias · CVE (1)

  • CVE-2021-23369 The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References