| 0 |
| url |
VCID-25sr-kapq-dbea |
| vulnerability_id |
VCID-25sr-kapq-dbea |
| summary |
Denial of Service in handlebars
Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.
## Recommendation
Upgrade to version 4.4.5 or later. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/handlebars@4.4.5 |
| purl |
pkg:npm/handlebars@4.4.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2r9d-e4z2-ckbh |
|
| 1 |
| vulnerability |
VCID-3ej8-4wrb-dqed |
|
| 2 |
| vulnerability |
VCID-4e4r-qabs-cbg7 |
|
| 3 |
| vulnerability |
VCID-4sp5-ymgy-qfg4 |
|
| 4 |
| vulnerability |
VCID-7c3a-mqkm-3ycc |
|
| 5 |
| vulnerability |
VCID-81p2-vehj-hub1 |
|
| 6 |
| vulnerability |
VCID-bkew-8c9k-mbh2 |
|
| 7 |
| vulnerability |
VCID-cxf4-xmgb-aue5 |
|
| 8 |
| vulnerability |
VCID-q9rt-jtx1-hybx |
|
| 9 |
| vulnerability |
VCID-rrb5-uk9f-zbc8 |
|
| 10 |
| vulnerability |
VCID-s9ab-ntdt-vkgd |
|
| 11 |
| vulnerability |
VCID-uv5v-22z9-fbfg |
|
| 12 |
| vulnerability |
VCID-xxez-8xav-cfdz |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/handlebars@4.4.5 |
|
|
| aliases |
GHSA-f52g-6jhx-586p, GMS-2020-728
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-25sr-kapq-dbea |
|
| 1 |
|
| 2 |
| url |
VCID-3ej8-4wrb-dqed |
| vulnerability_id |
VCID-3ej8-4wrb-dqed |
| summary |
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-23383, GHSA-765h-qjxv-5f44
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3ej8-4wrb-dqed |
|
| 3 |
|
| 4 |
|
| 5 |
| url |
VCID-7c3a-mqkm-3ycc |
| vulnerability_id |
VCID-7c3a-mqkm-3ycc |
| summary |
Improper Control of Generation of Code ('Code Injection')
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS). |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-20920, GHSA-3cqr-58rm-57f8
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7c3a-mqkm-3ycc |
|
| 6 |
|
| 7 |
|
| 8 |
| url |
VCID-cfg5-1ju5-73b1 |
| vulnerability_id |
VCID-cfg5-1ju5-73b1 |
| summary |
Uncontrolled Resource Consumption
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/handlebars@4.4.5 |
| purl |
pkg:npm/handlebars@4.4.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2r9d-e4z2-ckbh |
|
| 1 |
| vulnerability |
VCID-3ej8-4wrb-dqed |
|
| 2 |
| vulnerability |
VCID-4e4r-qabs-cbg7 |
|
| 3 |
| vulnerability |
VCID-4sp5-ymgy-qfg4 |
|
| 4 |
| vulnerability |
VCID-7c3a-mqkm-3ycc |
|
| 5 |
| vulnerability |
VCID-81p2-vehj-hub1 |
|
| 6 |
| vulnerability |
VCID-bkew-8c9k-mbh2 |
|
| 7 |
| vulnerability |
VCID-cxf4-xmgb-aue5 |
|
| 8 |
| vulnerability |
VCID-q9rt-jtx1-hybx |
|
| 9 |
| vulnerability |
VCID-rrb5-uk9f-zbc8 |
|
| 10 |
| vulnerability |
VCID-s9ab-ntdt-vkgd |
|
| 11 |
| vulnerability |
VCID-uv5v-22z9-fbfg |
|
| 12 |
| vulnerability |
VCID-xxez-8xav-cfdz |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/handlebars@4.4.5 |
|
|
| aliases |
CVE-2019-20922, GHSA-62gr-4qp9-h98f
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cfg5-1ju5-73b1 |
|
| 9 |
|
| 10 |
| url |
VCID-f1td-t6kf-wfcm |
| vulnerability_id |
VCID-f1td-t6kf-wfcm |
| summary |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in handlebars. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/handlebars@4.0.14 |
| purl |
pkg:npm/handlebars@4.0.14 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-25sr-kapq-dbea |
|
| 1 |
| vulnerability |
VCID-2r9d-e4z2-ckbh |
|
| 2 |
| vulnerability |
VCID-3ej8-4wrb-dqed |
|
| 3 |
| vulnerability |
VCID-4e4r-qabs-cbg7 |
|
| 4 |
| vulnerability |
VCID-4sp5-ymgy-qfg4 |
|
| 5 |
| vulnerability |
VCID-7c3a-mqkm-3ycc |
|
| 6 |
| vulnerability |
VCID-81p2-vehj-hub1 |
|
| 7 |
| vulnerability |
VCID-bkew-8c9k-mbh2 |
|
| 8 |
| vulnerability |
VCID-cfg5-1ju5-73b1 |
|
| 9 |
| vulnerability |
VCID-cxf4-xmgb-aue5 |
|
| 10 |
| vulnerability |
VCID-nhz2-v28w-gye1 |
|
| 11 |
| vulnerability |
VCID-q9rt-jtx1-hybx |
|
| 12 |
| vulnerability |
VCID-rrb5-uk9f-zbc8 |
|
| 13 |
| vulnerability |
VCID-s9ab-ntdt-vkgd |
|
| 14 |
| vulnerability |
VCID-uv5v-22z9-fbfg |
|
| 15 |
| vulnerability |
VCID-xxez-8xav-cfdz |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/handlebars@4.0.14 |
|
| 1 |
| url |
pkg:npm/handlebars@4.1.2 |
| purl |
pkg:npm/handlebars@4.1.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-25sr-kapq-dbea |
|
| 1 |
| vulnerability |
VCID-2r9d-e4z2-ckbh |
|
| 2 |
| vulnerability |
VCID-3ej8-4wrb-dqed |
|
| 3 |
| vulnerability |
VCID-4e4r-qabs-cbg7 |
|
| 4 |
| vulnerability |
VCID-4sp5-ymgy-qfg4 |
|
| 5 |
| vulnerability |
VCID-7c3a-mqkm-3ycc |
|
| 6 |
| vulnerability |
VCID-81p2-vehj-hub1 |
|
| 7 |
| vulnerability |
VCID-bkew-8c9k-mbh2 |
|
| 8 |
| vulnerability |
VCID-cfg5-1ju5-73b1 |
|
| 9 |
| vulnerability |
VCID-cxf4-xmgb-aue5 |
|
| 10 |
| vulnerability |
VCID-nhz2-v28w-gye1 |
|
| 11 |
| vulnerability |
VCID-q9rt-jtx1-hybx |
|
| 12 |
| vulnerability |
VCID-rrb5-uk9f-zbc8 |
|
| 13 |
| vulnerability |
VCID-s9ab-ntdt-vkgd |
|
| 14 |
| vulnerability |
VCID-uv5v-22z9-fbfg |
|
| 15 |
| vulnerability |
VCID-xxez-8xav-cfdz |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/handlebars@4.1.2 |
|
|
| aliases |
GHSA-q42p-pg8m-cqh6, GMS-2019-126
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-f1td-t6kf-wfcm |
|
| 11 |
| url |
VCID-nhz2-v28w-gye1 |
| vulnerability_id |
VCID-nhz2-v28w-gye1 |
| summary |
Prototype Pollution in handlebars
The bootstrap-wysihtml5-rails gem includes the vendored JavaScript library 'handlebars.js'.
Versions 0.3.3.7-0.3.3.8 include handlebars 3.0.2, and versions 0.3.3.5-0.3.3.6 include handlebars 1.3.0.
Versions Affected: 0.3.3.5-0.3.3.8
Not affected: < 0.3.3.5
Fixed Versions: None
Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.
Templates may alter an Objects' __proto__ and __defineGetter__ properties, which may allow an attacker to execute
arbitrary code through crafted payloads. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/handlebars@4.3.0 |
| purl |
pkg:npm/handlebars@4.3.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-25sr-kapq-dbea |
|
| 1 |
| vulnerability |
VCID-2r9d-e4z2-ckbh |
|
| 2 |
| vulnerability |
VCID-3ej8-4wrb-dqed |
|
| 3 |
| vulnerability |
VCID-4e4r-qabs-cbg7 |
|
| 4 |
| vulnerability |
VCID-4sp5-ymgy-qfg4 |
|
| 5 |
| vulnerability |
VCID-7c3a-mqkm-3ycc |
|
| 6 |
| vulnerability |
VCID-81p2-vehj-hub1 |
|
| 7 |
| vulnerability |
VCID-bkew-8c9k-mbh2 |
|
| 8 |
| vulnerability |
VCID-cfg5-1ju5-73b1 |
|
| 9 |
| vulnerability |
VCID-cxf4-xmgb-aue5 |
|
| 10 |
| vulnerability |
VCID-q9rt-jtx1-hybx |
|
| 11 |
| vulnerability |
VCID-rrb5-uk9f-zbc8 |
|
| 12 |
| vulnerability |
VCID-s9ab-ntdt-vkgd |
|
| 13 |
| vulnerability |
VCID-uv5v-22z9-fbfg |
|
| 14 |
| vulnerability |
VCID-xxez-8xav-cfdz |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/handlebars@4.3.0 |
|
|
| aliases |
CVE-2019-19919, GHSA-w457-6q6x-cgp9
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nhz2-v28w-gye1 |
|
| 12 |
|
| 13 |
| url |
VCID-rrb5-uk9f-zbc8 |
| vulnerability_id |
VCID-rrb5-uk9f-zbc8 |
| summary |
Handlebars.js has a Property Access Validation Bypass in container.lookup
## Summary
In `lib/handlebars/runtime.js`, the `container.lookup()` function uses `container.lookupProperty()` as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (`depths[i][name]`). This Time-of-Check Time-of-Use (TOCTOU) pattern means the security check and the actual read are decoupled, and the raw access bypasses any sanitization that `lookupProperty` may perform.
Only relevant when the **compat** compile option is enabled (`{compat: true}`), which activates `depthedLookup` in `lib/handlebars/compiler/javascript-compiler.js`.
## Description
The vulnerable code in `lib/handlebars/runtime.js` (lines 137–144):
```javascript
lookup: function (depths, name) {
const len = depths.length;
for (let i = 0; i < len; i++) {
let result = depths[i] && container.lookupProperty(depths[i], name);
if (result != null) {
return depths[i][name]; // BUG: should be `return result;`
}
}
},
```
`container.lookupProperty()` (lines 119–136) enforces `hasOwnProperty` checks and `resultIsAllowed()` prototype-access controls. However, `container.lookup()` only uses `lookupProperty` as a boolean gate — if the gate passes (`result != null`), it then performs an independent, raw `depths[i][name]` access that circumvents any transformation or wrapped value that `lookupProperty` may have returned.
## Workarounds
- Avoid enabling `{ compat: true }` when rendering templates that include untrusted data.
- Ensure context data objects are plain JSON (no Proxies, no getter-based accessor properties). |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-442j-39wm-28r2
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rrb5-uk9f-zbc8 |
|
| 14 |
|
| 15 |
|
| 16 |
| url |
VCID-xxez-8xav-cfdz |
| vulnerability_id |
VCID-xxez-8xav-cfdz |
| summary |
Remote code execution in handlebars when compiling templates
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when
selecting certain compiling options to compile templates coming from an untrusted source.
This vulnerability has been assigned the CVE identifier CVE-2021-23369. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-23369, GHSA-f2jv-r9rf-7988
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xxez-8xav-cfdz |
|