# CVE-2019-20920: Handlebars arbitrary code execution in lookup helper

Source: https://junglewise.ai/threats/cve-2019-20920-handlebars-arbitrary-code-execution-in-lookup-helper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-10. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2019-20920 · Severity: low · CVSS 3.1 · Published 2022-02-10

Handlebars, a popular web templating engine, is vulnerable to a flaw that allows attackers to execute unauthorized code. By submitting a specially crafted template, an attacker can run arbitrary JavaScript on the server or in a user's browser. This could lead to full server takeover, data theft, or the compromise of user sessions via Cross-Site Scripting (XSS).

## Quick answers

**Is CVE-2019-20920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-20920 being exploited in the wild.

**How severe is CVE-2019-20920?** Low severity, with a CVSS score of 3.1, published 10 February 2022.

**Which products and versions are affected?** Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.3.

**Is there a fix for CVE-2019-20920?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-20920 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-20920?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Handlebars versions before 3.0.8 and 4.x before 4.5.3 are vulnerable to arbitrary code execution (CWE-94). The root cause is a failure in the 'lookup' helper to properly validate templates, specifically when checking for the 'constructor' property. An attacker can exploit this by submitting a malicious template that bypasses security restrictions to execute arbitrary JavaScript. This can occur either on the server-side (Remote Code Execution) or client-side (Cross-Site Scripting) depending on where the template is processed. The vulnerability is patched in versions 3.0.8 and 4.5.3.

## Affected products

- Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.3

## Identifiers

- CVE-2019-20920
- GHSA-3cqr-58rm-57f8

## Timeline

- 2019-11-14: disclosed: Vulnerability disclosed by Francois Lajeunesse-Robert
- 2020-09-30: advisory: NVD published CVE-2019-20920
- 2022-02-10: advisory: GitHub Advisory published

## References

- [https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee](https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee)
- [https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e](https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e)
- [https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478](https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478)
- [https://www.npmjs.com/advisories/1316](https://www.npmjs.com/advisories/1316)
- [https://www.npmjs.com/advisories/1324](https://www.npmjs.com/advisories/1324)
- [https://www.npmjs.com/package/handlebars](https://www.npmjs.com/package/handlebars)