Prototype pollution in handlebars
Priority MEDIUM 56CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04506 91st percentileScored 2026-11-07
Fix Partial handlebars: 4.7.7handlebars (npm): 4.7.7Red Hat: 4 advisoriesRed Hat: 4 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | handlebars | before 4.7.7 | 4.7.7 | Patch available | CNA |
| — | handlebars (npm) | before 4.7.7 | 4.7.7 | Patch available | GHSA-765h-qjxv-5f44 |
- handlebars Vendor— Affected before 4.7.7 Fixed in 4.7.7 Patch available CNA
- handlebars (npm) Vendor— Affected before 4.7.7 Fixed in 4.7.7 Patch available GHSA-765h-qjxv-5f44
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* | before 4.7.7 | Vulnerable | handlebars-lang |
| cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* Versions before 4.7.7 Vulnerable ·handlebars-lang
- cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA handlebars Fixed in 4.7.7
- Fix · GHSA-765h-qjxv-5f44 handlebars (npm) Fixed in 4.7.7 Advisory →
Red Hat 4 advisories
- RHSA-2023:1334 Released 2023-03-20 · Red Hat rating CriticalRed Hat Process Automation Manager 7.13.2 security update
- RHPAM 7.13.1 async
- RHSA-2021:4032 Released 2021-11-17 · Red Hat rating LowOpenshift Logging 5.2.3 bug fix and security update
- OpenShift Logging 5.2 openshift-logging/kibana6-rhel8
- RHSA-2021:4628 Released 2021-11-17 · Red Hat rating LowOpenshift Logging 5.1.4 bug fix and security update
- OpenShift Logging 5.1 openshift-logging/kibana6-rhel8
Show 1 more Red Hat advisories
- RHSA-2021:2500 Released 2021-06-29 · Red Hat rating ModerateRed Hat OpenShift Enterprise security and bug fix update
- Red Hat OpenShift Container Platform 4.6 openshift4/ose-logging-kibana6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| OpenShift Logging 5.1 | Fixed | RHSA-2021:4628 |
| OpenShift Logging 5.2 | Fixed | RHSA-2021:4032 |
| RHPAM 7.13.1 async | Fixed | RHSA-2023:1334 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2021:2500 |
Not affected: 4 products
- OpenShift Logging 5.1
- OpenShift Logging 5.2
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4.6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23383
- 2026-10-03 Alias added: GHSA-765h-qjxv-5f44
- 2026-10-08 CISA SSVC decision points changed
References
Patch 1
Advisory 2
Sources
- CVE-2021-23383 · CVE Program
- CVE-2021-23383 · NVD
- FIRST EPSS
- GHSA-765h-qjxv-5f44 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23383 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences