Read the docs
TI-2021-06062 Aliases CVE-2021-23369GHSA-f2jv-r9rf-7988

Remote code execution (RCE) in handlebars

Priority MEDIUM 59CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.07028 94th percentileScored 2026-11-07
Fix Partial handlebars: 4.7.7handlebars (npm): 4.7.7+3 more productsRed Hat: 4 advisoriesRed Hat: 4 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—handlebarsbefore 4.7.74.7.7Patch availableCNA
—handlebars (npm)before 4.7.74.7.7Patch availableGHSA-f2jv-r9rf-7988
—org.webjars:handlebars (Maven)before 4.7.74.7.7Patch availableGHSA-f2jv-r9rf-7988
—org.webjars.npm:handlebars (Maven)before 4.7.74.7.7Patch availableGHSA-f2jv-r9rf-7988
—org.webjars.bowergithub.wycats:handlebars.js (Maven)before 4.7.74.7.7Patch availableGHSA-f2jv-r9rf-7988
  • handlebars Vendor— Affected before 4.7.7 Fixed in 4.7.7 Patch available CNA
  • handlebars (npm) Vendor— Affected before 4.7.7 Fixed in 4.7.7 Patch available GHSA-f2jv-r9rf-7988
  • org.webjars:handlebars (Maven) Vendor— Affected before 4.7.7 Fixed in 4.7.7 Patch available GHSA-f2jv-r9rf-7988
  • org.webjars.npm:handlebars (Maven) Vendor— Affected before 4.7.7 Fixed in 4.7.7 Patch available GHSA-f2jv-r9rf-7988
  • org.webjars.bowergithub.wycats:handlebars.js (Maven) Vendor— Affected before 4.7.7 Fixed in 4.7.7 Patch available GHSA-f2jv-r9rf-7988

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*before 4.7.7Vulnerablehandlebars-lang
  • cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* Versions before 4.7.7 Vulnerable ·handlebars-lang

Remediation

  • Fix · CNA handlebars Fixed in 4.7.7
  • Fix · GHSA-f2jv-r9rf-7988 handlebars (npm) Fixed in 4.7.7 Advisory →
  • Fix · GHSA-f2jv-r9rf-7988 org.webjars:handlebars (Maven) Fixed in 4.7.7 Advisory →
  • Fix · GHSA-f2jv-r9rf-7988 org.webjars.npm:handlebars (Maven) Fixed in 4.7.7 Advisory →
  • Fix · GHSA-f2jv-r9rf-7988 org.webjars.bowergithub.wycats:handlebars.js (Maven) Fixed in 4.7.7 Advisory →

Red Hat 4 advisories

  • RHSA-2023:1334 Released 2023-03-20 · Red Hat rating Critical
    Red Hat Process Automation Manager 7.13.2 security update
    • RHPAM 7.13.1 async
  • RHSA-2021:4032 Released 2021-11-17 · Red Hat rating Low
    Openshift Logging 5.2.3 bug fix and security update
    • OpenShift Logging 5.2 openshift-logging/kibana6-rhel8
  • RHSA-2021:4628 Released 2021-11-17 · Red Hat rating Low
    Openshift Logging 5.1.4 bug fix and security update
    • OpenShift Logging 5.1 openshift-logging/kibana6-rhel8
Show 1 more Red Hat advisories
  • RHSA-2021:2500 Released 2021-06-29 · Red Hat rating Moderate
    Red Hat OpenShift Enterprise security and bug fix update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-kibana6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Storage 3AffectedNo fix yet: Fix deferred
Red Hat Virtualization 4AffectedNo fix planned: Will not fix
OpenShift Logging 5.1Fixed RHSA-2021:4628
OpenShift Logging 5.2Fixed RHSA-2021:4032
RHPAM 7.13.1 asyncFixed RHSA-2023:1334
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:2500
Not affected: 5 products
  • OpenShift Logging 5.1
  • OpenShift Logging 5.2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23369
  2. 2026-10-03 Alias added: GHSA-f2jv-r9rf-7988
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 2

Advisory 2

Other 2

  • TI-2026-26288 Handlebars.js has JavaScript Injection via AST Type Confusion CVSS 3.1CRITICAL 9.8
  • TI-2026-26290 Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation CVSS 3.1HIGH 7.5
  • TI-2026-26292 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options CVSS 3.1HIGH 8.3
  • TI-2026-26291 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial CVSS 3.1HIGH 8.1
  • TI-2026-26289 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block CVSS 3.1HIGH 8.1
  • TI-2021-06076 Prototype pollution in handlebars CVSS 3.1CRITICAL 9.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences