What’s Vulnerable › Vulnerabilities

CVE-2021-23383: Prototype Pollution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-04 · updated 2026-10-08
• Weakness: CWE-1321

Description

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Affected products

• handlebars-lang handlebars.js: before 4.7.7 — fixed in 4.7.7
• NetApp E-Series Performance Analyzer: all versions
• Npm Handlebars: before 4.7.7 — fixed in 4.7.7

How to fix

Upgrade to a fixed version: handlebars-lang handlebars.js 4.7.7; Npm Handlebars 4.7.7. Check the vendor advisory for mitigations.

References

• https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
• https://security.netapp.com/advisory/ntap-20210618-0007/
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
• https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
• https://security.netapp.com/advisory/ntap-20210618-0007/
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029

Get alerted when CVE-2021-23383 or the next vulnerability affects your stack