Critical Remote Code Execution Vulnerability in Handlebars Package
Summary
CVE-2021-23369: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source. Affects node-handlebars across 3 version ranges.
< 3:4.7.6+~4.1.0-2
< b6d3de7123eebba603e321f04afdbae608e8fea8
< f0589701698268578199be25285b2ebea1c1e427
Fixed in 3:4.7.6+~4.1.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Handlebars is a popular templating engine used in web development to generate HTML dynamically. It allows developers to create templates that can be populated with data, making it easier to build dynamic web applications. The Handlebars package is widely used in various JavaScript frameworks and libraries. However, prior to version 4.7.7, Handlebars is susceptible to a critical vulnerability that can lead to remote code execution when templates from untrusted sources are compiled with certain options.
Vulnerability Detail
The vulnerability, identified as CVE-2021-23369, arises from the way Handlebars compiles templates. When using specific compiling options, an attacker can exploit this vulnerability by providing malicious templates that, when processed, can execute arbitrary code on the server. This poses a significant risk, as it can lead to unauthorized access, data breaches, and complete system compromise. The vulnerability affects multiple versions of the Handlebars package, specifically those before version 4.7.7, and has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
3:4.7.6+~4.1.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-handlebarsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing strict validation of templates before compilation. Ensure that only trusted templates are processed and avoid using any user-generated content in your templates. Additionally, you can disable any compiling options that may expose the application to this vulnerability.
Conclusion
The CVE-2021-23369 vulnerability in the Handlebars package poses a serious risk of remote code execution. Users are strongly advised to upgrade to version 4.7.7 or later to protect their applications. Implementing strict validation of templates can serve as a temporary workaround while the upgrade is being planned.
See every vulnerability recorded for node-handlebars →
FAQ
CVE-2021-23369 is a critical vulnerability in the Handlebars package that allows for remote code execution when compiling untrusted templates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potentially complete control over the affected system.
Yes, you can implement strict validation of templates and avoid processing untrusted content as a temporary measure.
It is recommended to upgrade to Handlebars version 4.7.7 or later to ensure that the vulnerability is patched.
Related vulnerabilities
Recent vulnerabilities recorded for node-handlebars.
