CVE-2021-23369

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-23369

CGA ID

CGA-44wj-j3rp-jg3r

Severity

9.8

Critical

CVSS V3

Description

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

References

https://images.chainguard.dev/security/CGA-44wj-j3rp-jg3r
https://github.com/advisories/GHSA-f2jv-r9rf-7988
https://security.netapp.com/advisory/ntap-20210604-0008/
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952
https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767
https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
https://security-tracker.debian.org/tracker/CVE-2021-23369

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Media Kit Contact Us

Private Policy

CVE-2021-23369

Severity

Description

References

Affected packages

Product

Why Chainguard

Customers

Company

Resources