CVE-2019-20920 Arbitrary Code Execution in Handlebars

What is CVE-2019-20920?

CVE-2019-20920 is a high-severity vulnerability in n/a, published on 30 Sep 2020.

Official description

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Weakness: CWE-94

Which versions are affected by CVE-2019-20920?

4 open source packages ship an affected version, including handlebars. It affects 1 product.

Products include Handlebarsjs Handlebars.

How do I fix CVE-2019-20920?

Upgrade handlebars to a fixed version for your release line: 3.0.8 or 4.5.3.

Is CVE-2019-20920 being exploited?

There is no known exploitation of CVE-2019-20920 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion Critical 9.8
• CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options High 8.3
• CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block High 8.1
• CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial High 8.1
• CVE-2026-33939 Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-20920, GHSA-3cqr-58rm-57f8, MINI-446m-rr6q-r26p, ROOT-APP-NPM-CVE-2019-20920, SNYK-JS-HANDLEBARS-534478, UBUNTU-CVE-2019-20920.