Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-23383

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-23383
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:14 UTC · Revision 1

Source evidence

CVE-2021-23383

core-osv · Original source

Published 4 May 2021, 09:15 UTC

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

osv:CVE-2021-23383
Complete source record
{
  "id": "7fd64d206c95bc64431e6a536b51749bdd404c71afe0d321106003f82ed65070",
  "url": "https://osv.dev/vulnerability/CVE-2021-23383",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-23383",
    "summary": "The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.",
    "evidence": "osv:CVE-2021-23383",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2021-23383",
      "aliases": [
        "CVE-2021-23383",
        "GHSA-765h-qjxv-5f44"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/handlebars-lang/handlebars.js",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a9a8e403213583ca90cb7c872d3a22796c37d961"
                },
                {
                  "fixed": "f0589701698268578199be25285b2ebea1c1e427"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.7.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "f0589701698268578199be25285b2ebea1c1e427"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.7.6",
            "v4.7.5",
            "v4.7.4",
            "v4.7.3",
            "v4.7.2",
            "v4.7.1",
            "v4.7.0",
            "v4.6.0",
            "v4.5.3",
            "v4.5.2",
            "v4.5.1",
            "v4.5.0",
            "v4.4.3",
            "v4.4.2",
            "v4.4.1",
            "v4.2.1",
            "v4.3.4",
            "v4.4.0",
            "v4.3.3",
            "v4.3.2",
            "v4.3.1",
            "v4.3.0",
            "v4.2.0",
            "v4.1.2-0",
            "v4.1.2",
            "v1.3.0",
            "v4.1.1",
            "v4.0.12",
            "v4.0.11",
            "v4.0.10",
            "v4.0.9",
            "v4.0.8",
            "v4.0.7",
            "v4.0.6",
            "v4.0.5",
            "v3.0.3",
            "v4.0.4",
            "v4.0.3",
            "v4.0.2",
            "v4.0.1",
            "v4.0.0",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v2.0.0",
            "v2.0.0-beta.1",
            "v2.0.0-alpha.4",
            "v2.0.0-alpha.3",
            "v2.0.0-alpha.2",
            "v2.0.0-alpha.1",
            "v1.2.1",
            "v1.2.0",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.12",
            "1.0.0",
            "v1.0.11",
            "1.0.0-rc.4",
            "v1.0.10",
            "v1.0.9",
            "1.0.0-rc.3",
            "v1.0.8",
            "1.0.rc.2",
            "v1.0.6-2",
            "v1.0.6",
            "v1.0.6beta",
            "1.0.0.beta.1",
            "0.9.0.pre.4"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23383.json"
          }
        }
      ],
      "modified": "2026-10-20T10:53:37.187019156Z",
      "provider": "osv",
      "references": [
        "https://security.netapp.com/advisory/ntap-20210618-0007/",
        "https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427",
        "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031",
        "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032",
        "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030",
        "https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-23383",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 384439,
  "published_at": "2021-05-04T09:15:07.753+00:00"
}