Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-23383: Handlebars library can run malicious code
CVE-2021-23383 · published today
Summary
The Handlebars templating library used in several packages—including jaylinski/handlebars, handlebarsjs/handlebars, NetApp's e-series performance analyzer, rootio/@rootio/handlebars, and the generic handlebars package—is vulnerable to code that could be executed by an attacker. This can let an attacker take control of the affected system. Update all Handlebars components to the newest released versions as soon as possible.
What to do
- Update jaylinski handlebars to version 4.7.7.
- Update rootio @rootio/handlebars to version 4.7.7-root.io.3.
- Update jaylinski handlebars to version 4.7.7-aikido.3.
- Update handlebars to version 4.7.7-aikido.5.
- Update rootio @rootio/handlebars to version 4.7.7-root.io.5.
- Update handlebarsjs handlebars to version 4.7.7 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | jaylinski | handlebars |
< 4.7.7 Fix: upgrade to 4.7.7
|
| – | handlebarsjs | handlebars |
< 4.7.7 cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* |
| – | netapp | e-series_performance_analyzer |
All versions
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* |
| Root:npm | rootio | @rootio/handlebars |
< 4.7.7-root.io.3 < 4.7.7-root.io.5 Fix: upgrade to 4.7.7-root.io.3
|
| Root:npm | jaylinski | handlebars |
< 4.7.7-aikido.3 Fix: upgrade to 4.7.7-aikido.3
|
| – | – | handlebars | < 4.7.7 |
| Root:npm | – | handlebars |
< 4.7.7-aikido.5 Fix: upgrade to 4.7.7-aikido.5
|
Original advisory text
CVE-2021-23383 in handlebars - Patched by Root
Root has patched CVE-2021-23383 in the handlebars package for Root:npm. Multiple fixed versions available.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23383
- https://www.npmjs.com/package/handlebars
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/handlebars-source/C...
- https://github.com/advisories/GHSA-765h-qjxv-5f44
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25... Patch Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210618-0007/ Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 Exploit Patch Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 Exploit Patch Third Party Advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 Exploit Patch Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 Exploit Patch Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-1321Prototype Pollution
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta