CVE-2019-20920: Arbitrary Code Execution in Handlebars

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-09-30 · updated 2026-10-08
Weakness: CWE-94

Description

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Affected products

handlebars-lang handlebars.js: before 3.0.8; from 4.0.0 before 4.5.3 — fixed in 3.0.8, 4.5.3
Npm Handlebars: before 3.0.8; from 4.0.0 before 4.5.3 — fixed in 3.0.8, 4.5.3

How to fix

Upgrade to a fixed version: handlebars-lang handlebars.js 3.0.8, 4.5.3; Npm Handlebars 3.0.8, 4.5.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-20920 or the next vulnerability affects your stack