crítica
CVE-2021-23369
nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Ruby Advisory DB. Más baja según Red Hat (media), Ubuntu (media).
Descripción
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.webjars.bowergithub.wycats:handlebars.js, org.webjars.npm:handlebars, org.webjars:handlebars | 4.7.7 |
| npm::GitHub Security Advisory npm | handlebars | 4.7.7 |
| rubygems::Ruby Advisory Database | handlebars-source | >= 4.7.7 |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 y 35 más | 0 y 1 más |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u3 |
| debian 11 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 12 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 13 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 14 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 9 | libjs-handlebars | sin corrección indicada |
| echo | node-handlebars | 3:4.7.6+~4.1.0-2 |
| Red Hat | kibana, ovirt-engine-ui-extensions, ovirt-web-ui y 6 más | sin corrección indicada |
Mostrar las 65 entradas de 17 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.webjars.bowergithub.wycats:handlebars.js | 4.7.7 |
| maven::GitHub Security Advisory Maven | org.webjars.npm:handlebars | 4.7.7 |
| maven::GitHub Security Advisory Maven | org.webjars:handlebars | 4.7.7 |
| npm::GitHub Security Advisory npm | handlebars | 4.7.7 |
| rubygems::Ruby Advisory Database | handlebars-source | >= 4.7.7 |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 19.4.0-r1 |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u3 |
| debian 11 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 12 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 13 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 14 | node-handlebars | 3:4.7.6+~4.1.0-2 |
| debian 9 | libjs-handlebars | sin corrección indicada |
| echo | node-handlebars | 3:4.7.6+~4.1.0-2 |
| Red Hat | kibana | sin corrección indicada |
| Red Hat | ovirt-engine-ui-extensions | sin corrección indicada |
| Red Hat | ovirt-web-ui | sin corrección indicada |
| Red Hat | pcs | sin corrección indicada |
| Red Hat | pcs-snmp | sin corrección indicada |
| Red Hat | python-clufter | sin corrección indicada |
| Red Hat | servicemesh-grafana | sin corrección indicada |
| Red Hat | servicemesh-grafana-prometheus | sin corrección indicada |
| Red Hat | servicemesh-prometheus | sin corrección indicada |
| seal npm::Seal Security Database | @seal-security/handlebars | 4.1.2-sp999 |
| seal npm::Seal Security Database | handlebars | 4.1.2-sp999 |
| ubuntu 18.04-ESM | node-handlebars | sin corrección indicada |
| ubuntu 20.04-ESM | node-handlebars | sin corrección indicada |
| ubuntu 22.04 | node-handlebars | sin corrección indicada |
| wolfi | code-server | 0 |
Referencias
- https://access.redhat.com/security/cve/CVE-2021-23369
- https://github.com/advisories/GHSA-f2jv-r9rf-7988
- https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
- https://github.com/wycats/handlebars.js
- https://nvd.nist.gov/vuln/detail/CVE-2021-23369
- https://security.netapp.com/advisory/ntap-20210604-0008
- https://security.netapp.com/advisory/ntap-20210604-0008/