Quick answers
- Is CVE-2021-23383 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-23383 being exploited in the wild.
- How severe is CVE-2021-23383?
- Low severity, with a CVSS score of 3.1, published 10 February 2022.
- Which products and versions are affected?
- handlebars (npm) SEMVER:introduced=0,fixed=4.7.7.
- Is there a fix for CVE-2021-23383?
- Yes. handlebars (npm): upgrade to 4.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-23383 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-23383?
- Check whether you run handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- handlebars (npm): upgrade to 4.7.7 or later
npm install handlebars@4.7.7
Technical details
This vulnerability is a prototype pollution flaw (CWE-1321) in the Handlebars templating library when compiling templates from untrusted sources under specific compilation options. The vulnerable component is the JavaScript compiler that processes template options, failing to properly escape property names. An attacker who can control template input to the compiler can inject properties into the Object prototype, affecting all JavaScript objects in the application. The attack requires specific compilation options to be enabled but does not require authentication or user interaction. Fix is available in version 4.7.7 and later.
Affected products
- Handlebars Handlebars before 4.7.7
Identifiers
- CVE-2021-23383
- GHSA-765h-qjxv-5f44
Timeline
- 2021-05-04: disclosed: Published to NVD
- 2021-05-19: patched: Fix released in Handlebars 4.7.7