Package
gitlab-rails-ce-assets-19.5
Component
handlebars
Latest update
9.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2021-23369 affects the handlebars npm package (fixed in 4.7.7, https://github.com/advisories/GHSA-f2jv-r9rf-7988). The file matched here, /srv/gitlab/public/assets/webpack/gitlab-web-ide-vscode-workbench-0.0.1-dev-20260106142046/vscode/extensions/handlebars/package.json, is the manifest of VS Code's built-in Handlebars language extension (publisher vscode, version 1.0.0). That extension contains only language configuration and a syntax grammar, and no code from the handlebars npm package; scanners match it because the names are identical.
References: https://nvd.nist.gov/vuln/detail/CVE-2021-23369 https://github.com/advisories/GHSA-f2jv-r9rf-7988 https://github.com/coder/code-server/issues/6332 https://gitlab.com/gitlab-org/gitlab/-/issues/416595#note_1460681285
Status