Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2021-23383

crítica

CVE-2021-23383

nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option

Publicada Modificada CWE 1321
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Ruby Advisory DB. Más baja según Red Hat (media).

Descripción

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
npm::GitHub Security Advisory npmhandlebars4.7.7
rubygems::Ruby Advisory Databasehandlebars-source>= 4.7.7
chainguardcode-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 y 35 más0 y 1 más
debian 10node-handlebarssin corrección indicada
debian 11node-handlebars3:4.7.6+~4.1.0-2
debian 12node-handlebars3:4.7.6+~4.1.0-2
debian 13node-handlebars3:4.7.6+~4.1.0-2
debian 14node-handlebars3:4.7.6+~4.1.0-2
debian 9libjs-handlebarssin corrección indicada
echonode-handlebars3:4.7.6+~4.1.0-2
Red Hatkibana, pcs, pcs-snmp y 4 mássin corrección indicada
seal npm::Seal Security Database@seal-security/handlebars, handlebars4.1.2-sp999
Mostrar las 57 entradas de 13 fuentes
FuentePaqueteCorregido en
npm::GitHub Security Advisory npmhandlebars4.7.7
rubygems::Ruby Advisory Databasehandlebars-source>= 4.7.7
chainguardcode-server0
chainguardcommercial-gitlab-rails-ee-19.20
chainguardcommercial-gitlab-rails-ee-19.30
chainguardcommercial-gitlab-rails-ee-19.40
chainguardcommercial-gitlab-rails-ee-fips-19.20
chainguardcommercial-gitlab-rails-ee-fips-19.30
chainguardcommercial-gitlab-rails-ee-fips-19.40
chainguardgitlab-rails-ce-18.10
chainguardgitlab-rails-ce-18.110
chainguardgitlab-rails-ce-18.20
chainguardgitlab-rails-ce-18.30
chainguardgitlab-rails-ce-18.40
chainguardgitlab-rails-ce-18.50
chainguardgitlab-rails-ce-18.60
chainguardgitlab-rails-ce-18.70
chainguardgitlab-rails-ce-18.80
chainguardgitlab-rails-ce-18.90
chainguardgitlab-rails-ce-19.00
chainguardgitlab-rails-ce-19.10
chainguardgitlab-rails-ce-19.20
chainguardgitlab-rails-ce-19.30
chainguardgitlab-rails-ce-19.40
chainguardgitlab-rails-ce-19.50
chainguardgitlab-rails-ce-fips-18.10
chainguardgitlab-rails-ce-fips-18.110
chainguardgitlab-rails-ce-fips-18.20
chainguardgitlab-rails-ce-fips-18.30
chainguardgitlab-rails-ce-fips-18.40
chainguardgitlab-rails-ce-fips-18.50
chainguardgitlab-rails-ce-fips-18.60
chainguardgitlab-rails-ce-fips-18.70
chainguardgitlab-rails-ce-fips-18.80
chainguardgitlab-rails-ce-fips-18.90
chainguardgitlab-rails-ce-fips-19.00
chainguardgitlab-rails-ce-fips-19.10
chainguardgitlab-rails-ce-fips-19.20
chainguardgitlab-rails-ce-fips-19.30
chainguardgitlab-rails-ce-fips-19.419.4.0-r1
debian 10node-handlebarssin corrección indicada
debian 11node-handlebars3:4.7.6+~4.1.0-2
debian 12node-handlebars3:4.7.6+~4.1.0-2
debian 13node-handlebars3:4.7.6+~4.1.0-2
debian 14node-handlebars3:4.7.6+~4.1.0-2
debian 9libjs-handlebarssin corrección indicada
echonode-handlebars3:4.7.6+~4.1.0-2
Red Hatkibanasin corrección indicada
Red Hatpcssin corrección indicada
Red Hatpcs-snmpsin corrección indicada
Red Hatpython-cluftersin corrección indicada
Red Hatservicemesh-grafanasin corrección indicada
Red Hatservicemesh-grafana-prometheussin corrección indicada
Red Hatservicemesh-prometheussin corrección indicada
seal npm::Seal Security Database@seal-security/handlebars4.1.2-sp999
seal npm::Seal Security Databasehandlebars4.1.2-sp999
wolficode-server0

Referencias

Las 14 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.