CVE-2021-23369 Remote Code Execution (RCE)
Attackers can execute arbitrary code by compiling untrusted templates with specific options in the Handlebars library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23369?
CVE-2021-23369 is a medium-severity code injection vulnerability in handlebars, published on 12 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Which versions are affected by CVE-2021-23369?
8 open source packages ship an affected version, including org.webjars.bowergithub.wycats:handlebars.js, org.webjars.npm:handlebars and org.webjars:handlebars. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.webjars.bowergithub.wycats:handlebars.js Maven | All versions | 4.7.7 |
org.webjars.bowergithub.wycats:handlebars.js Maven | All versions | 4.7.7 |
org.webjars.npm:handlebars Maven | All versions | 4.7.7 |
org.webjars.npm:handlebars Maven | All versions | 4.7.7 |
org.webjars:handlebars Maven | All versions | 4.7.7 |
org.webjars:handlebars Maven | All versions | 4.7.7 |
2 more packages
handlebars npm | All versions | 4.7.7 |
handlebars npm | All versions | 4.7.7 |
Products include Handlebarsjs Handlebars.
How do I fix CVE-2021-23369?
Upgrade org.webjars.bowergithub.wycats:handlebars.js to 4.7.7 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-23369 being exploited?
There is no known exploitation of CVE-2021-23369 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in handlebars
- CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
- CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- CVE-2019-20920 Arbitrary Code Execution in Handlebars
Sources
Also known as DEBIAN-CVE-2021-23369, GHSA-f2jv-r9rf-7988, MINI-hp6p-282m-33gc, MINI-vqjr-65xx-8hj6, ROOT-APP-NPM-CVE-2021-23369, UBUNTU-CVE-2021-23369.