critical9.8
CVE-2021-23383
Prototype Pollution in handlebars
Impact
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | handlebars | < 4.7.7 | 4.7.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Handlebarsjs | Handlebars | before 4.7.7 |
| Netapp | E-Series Performance Analyzer | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
- https://security.netapp.com/advisory/ntap-20210618-0007/
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
- https://github.com/advisories/GHSA-765h-qjxv-5f44
- https://nvd.nist.gov/vuln/detail/CVE-2021-23383
- https://www.npmjs.com/package/handlebars
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/handlebars-source/CVE-2021-23383.yml