Remote code execution in handlebars when compiling templates

Description

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

Affected version(s): < 4.7.7
Patched version(s): 4.7.7

References

GHSA-f2jv-r9rf-7988
snyk.io
security.netapp.com
CVE-2021-23369
CWE-94
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Remote code execution in handlebars when compiling templates and gives you actionable findings to investigate.

Start a free scan

Related Issues

Angular Expressions - Remote Code Execution - CVE-2021-21277
Angular Expressions - Remote Code Execution when using locals - CVE-2024-54152
Remote code execution via the `pretty` option. - CVE-2021-21353
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas - CVE-2026-41138

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated November 29, 2023