CVE-2021-23383 Prototype Pollution

Medium 5.6 Published 4 May 2021 Updated 8 Oct 2026

Attackers can pollute prototypes in Handlebars templates from untrusted sources, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-23383?

CVE-2021-23383 is a medium-severity vulnerability in Netapp E-Series Performance Analyzer, published on 4 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Weakness: CWE-1321

Which versions are affected by CVE-2021-23383?

2 open source packages ship an affected version, including handlebars. It affects 2 products.

Package	Affected	Fixed in
`handlebars` npm	All versions	`4.7.7`
`handlebars` npm	All versions	`4.7.7`

Products include Handlebarsjs Handlebars, Netapp E-Series Performance Analyzer.

How do I fix CVE-2021-23383?

Upgrade handlebars to 4.7.7 or later.

Is CVE-2021-23383 being exploited?

There is no known exploitation of CVE-2021-23383 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

All Netapp E-Series Performance Analyzer vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-23383, GHSA-765h-qjxv-5f44, MINI-3242-7cjj-mjqg, MINI-jp48-642j-mjx2, OESA-2021-1196, ROOT-APP-NPM-CVE-2021-23383 and 1 more.