CVE-2021-23369: Remote Code Execution (RCE)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-12 · updated 2026-10-08

Description

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Affected products

handlebars-lang handlebars.js: before 4.7.7 — fixed in 4.7.7
Maven Org.Webjars.Bowergithub.Wycats:Handlebars.Js: before 4.7.7; 4.1.1, 4.2.0, 4.4.5, 4.5.3, 4.7.2 — fixed in 4.7.7
Maven Org.Webjars.Npm:Handlebars: before 4.7.7; 1.3.0, 2.0.0, 3.0.0, 3.0.1, 3.0.3, 4.0.11 (+15) — fixed in 4.7.7
Maven Org.Webjars:Handlebars: before 4.7.7; 1.0.0, 1.0.0-rc.3, 1.0.0-rc.4, 1.0.rc.1, 1.1.2, 1.2.1 (+15) — fixed in 4.7.7
Npm Handlebars: before 4.7.7 — fixed in 4.7.7

How to fix

Upgrade to a fixed version: handlebars-lang handlebars.js 4.7.7; Maven Org.Webjars.Bowergithub.Wycats:Handlebars.Js 4.7.7; Maven Org.Webjars.Npm:Handlebars 4.7.7; Maven Org.Webjars:Handlebars 4.7.7; Npm Handlebars 4.7.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-23369 or the next vulnerability affects your stack