Is CVE-2019-20920 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-20920 being exploited in the wild.

How severe is CVE-2019-20920?

Low severity, with a CVSS score of 3.1, published 10 February 2022.

Which products and versions are affected?

Handlebars.js handlebars = 4.0.0 < 4.5.3.

Is there a fix for CVE-2019-20920?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-20920 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-20920?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-20920: Handlebars arbitrary code execution in lookup helper

Q: Is there a fix for CVE-2019-20920?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2019-20920 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2019-20920?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-20920 · Severity: low · CVSS 3.1 · Published 2022-02-10

Handlebars, a popular web templating engine, is vulnerable to a flaw that allows attackers to execute unauthorized code. By submitting a specially crafted template, an attacker can run arbitrary JavaScript on the server or in a user's browser. This could lead to full server takeover, data theft, or the compromise of user sessions via Cross-Site Scripting (XSS).

Quick answers

Is CVE-2019-20920 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-20920 being exploited in the wild.
How severe is CVE-2019-20920?: Low severity, with a CVSS score of 3.1, published 10 February 2022.
Which products and versions are affected?: Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.3.
Is there a fix for CVE-2019-20920?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-20920 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-20920?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Handlebars versions before 3.0.8 and 4.x before 4.5.3 are vulnerable to arbitrary code execution (CWE-94). The root cause is a failure in the 'lookup' helper to properly validate templates, specifically when checking for the 'constructor' property. An attacker can exploit this by submitting a malicious template that bypasses security restrictions to execute arbitrary JavaScript. This can occur either on the server-side (Remote Code Execution) or client-side (Cross-Site Scripting) depending on where the template is processed. The vulnerability is patched in versions 3.0.8 and 4.5.3.

Affected products

Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.3

Identifiers

CVE-2019-20920
GHSA-3cqr-58rm-57f8

Timeline

2019-11-14: disclosed: Vulnerability disclosed by Francois Lajeunesse-Robert
2020-09-30: advisory: NVD published CVE-2019-20920
2022-02-10: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.