kritisch
CVE-2021-23369
nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Ruby Advisory DB. Niedriger laut Red Hat (mittel), Ubuntu (mittel).
Beschreibung
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.webjars.bowergithub.wycats:handlebars.js, org.webjars.npm:handlebars, org.webjars:handlebars | 4.7.7 |
| npm::GitHub Security Advisory npm | handlebars | 4.7.7 |
| rubygems::Ruby Advisory Database | handlebars-source | >= 4.7.7 |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 und 35 weitere | 0 und 1 weitere |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u3 |
| debian 11 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 12 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 13 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 14 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 9 | libjs-handlebars | kein Fix angegeben |
| echo | node-handlebars | 3:4.7.6+~4.1.0-2 |
| Red Hat | kibana, ovirt-engine-ui-extensions, ovirt-web-ui und 6 weitere | kein Fix angegeben |
Alle 65 Einträge aus 17 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.webjars.bowergithub.wycats:handlebars.js | 4.7.7 |
| maven::GitHub Security Advisory Maven | org.webjars.npm:handlebars | 4.7.7 |
| maven::GitHub Security Advisory Maven | org.webjars:handlebars | 4.7.7 |
| npm::GitHub Security Advisory npm | handlebars | 4.7.7 |
| rubygems::Ruby Advisory Database | handlebars-source | >= 4.7.7 |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 19.4.0-r1 |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u3 |
| debian 11 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 12 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 13 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 14 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 9 | libjs-handlebars | kein Fix angegeben |
| echo | node-handlebars | 3:4.7.6+~4.1.0-2 |
| Red Hat | kibana | kein Fix angegeben |
| Red Hat | ovirt-engine-ui-extensions | kein Fix angegeben |
| Red Hat | ovirt-web-ui | kein Fix angegeben |
| Red Hat | pcs | kein Fix angegeben |
| Red Hat | pcs-snmp | kein Fix angegeben |
| Red Hat | python-clufter | kein Fix angegeben |
| Red Hat | servicemesh-grafana | kein Fix angegeben |
| Red Hat | servicemesh-grafana-prometheus | kein Fix angegeben |
| Red Hat | servicemesh-prometheus | kein Fix angegeben |
| seal npm::Seal Security Database | @seal-security/handlebars | 4.1.2-sp999 |
| seal npm::Seal Security Database | handlebars | 4.1.2-sp999 |
| ubuntu 18.04-ESM | node-handlebars | kein Fix angegeben |
| ubuntu 20.04-ESM | node-handlebars | kein Fix angegeben |
| ubuntu 22.04 | node-handlebars | kein Fix angegeben |
| wolfi | code-server | 0 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2021-23369
- https://github.com/advisories/GHSA-f2jv-r9rf-7988
- https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
- https://github.com/wycats/handlebars.js
- https://nvd.nist.gov/vuln/detail/CVE-2021-23369
- https://security.netapp.com/advisory/ntap-20210604-0008
- https://security.netapp.com/advisory/ntap-20210604-0008/