Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-23369: Handlebars templates allow attackers to alter data

CVE-2021-23369 · published today

Summary

The Handlebars template library used in several web packages can be tricked into changing information it shouldn't. This could let an attacker modify content or settings within your application. Update to the latest versions of the Handlebars packages listed to protect your system.

What to do

Update jaylinski handlebars to version 4.7.7.
Update webjars org.webjars:handlebars to version 4.7.7.
Update webjars org.webjars.npm:handlebars to version 4.7.7.
Update webjars org.webjars.bowergithub.wycats:handlebars.js to version 4.7.7.
Update rootio @rootio/handlebars to version 4.7.7-root.io.3.
Update jaylinski handlebars to version 4.7.7-aikido.3.
Update handlebars to version 4.7.7-aikido.5.
Update rootio @rootio/handlebars to version 4.7.7-root.io.5.
Update handlebarsjs handlebars to version 4.7.7 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	jaylinski	handlebars	< 4.7.7 Fix: upgrade to 4.7.7
maven	webjars	org.webjars:handlebars	< 4.7.7 Fix: upgrade to 4.7.7
maven	webjars	org.webjars.npm:handlebars	< 4.7.7 Fix: upgrade to 4.7.7
maven	webjars	org.webjars.bowergithub.wycats:handlebars.js	< 4.7.7 Fix: upgrade to 4.7.7
–	handlebarsjs	handlebars	< 4.7.7 `cpe:2.3:a:handlebarsjs:handlebars::::::node.js::*`
Root:npm	rootio	@rootio/handlebars	< 4.7.7-root.io.3 < 4.7.7-root.io.5 Fix: upgrade to 4.7.7-root.io.3
Root:npm	jaylinski	handlebars	< 4.7.7-aikido.3 Fix: upgrade to 4.7.7-aikido.3
–	–	handlebars	< 4.7.7
Root:npm	–	handlebars	< 4.7.7-aikido.5 Fix: upgrade to 4.7.7-aikido.5

Original advisory text

CVE-2021-23369 in handlebars - Patched by Root

Root has patched CVE-2021-23369 in the handlebars package for Root:npm. Multiple fixed versions available.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-23369
https://github.com/advisories/GHSA-f2jv-r9rf-7988
https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f0... Patch Third Party Advisory
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25... Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20210604-0008/ Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952 Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767 Exploit Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

7% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published15 Oct 2026

Updated15 Oct 2026

First seen6 Mar 2026

Sources

GHSA-f2jv-r9rf-7988 · GHSA

CVE-2021-23369 · NVD

ROOT-APP-NPM-CVE-2021-23369 · OSV

CVE-2021-23369 · MITRE

Track software like this

Free during beta