CVE-2021-23383: Prototype Pollution in handlebars
Summary
CVE-2021-23383: Prototype Pollution in handlebars. Affects handlebars versions < 4.7.7. Fixed in 4.7.7. How to fix ↓
Also tracked for
- node-handlebars · Debian:11
The same CVE-2021-23383 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Handlebars is a popular JavaScript templating engine used for generating dynamic HTML content. It provides a simple and intuitive syntax for creating templates that can be rendered on the server or client-side. Handlebars allows developers to define placeholders in their templates and fill them with data during runtime. However, versions of handlebars prior to 4.7.7 are vulnerable to a Prototype Pollution issue when certain compiling options are used with templates from untrusted sources.
Vulnerability Detail
The Prototype Pollution vulnerability in handlebars arises due to improper handling of user-supplied input. When compiling templates from untrusted sources, an attacker can inject malicious data that manipulates the prototype of objects used by handlebars. This can lead to various security issues, including remote code execution, denial of service, or information disclosure. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 4.7.10 as of 22 Oct 2026
npm install handlebars@4.7.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.7.7
This is the first release that contains the fix.
npm install handlebars@4.7.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading handlebars is not immediately feasible, a possible workaround is to sanitize and validate any user-supplied input before passing it to handlebars.compile(). This can help mitigate the risk of Prototype Pollution. Here's an example of how to sanitize input in Node.js:
const handlebars = require('handlebars');
const sanitize = require('sanitize-html');
const template = '{{user.name}}';
const userInput = '<script>alert(1)</script>';
const sanitizedInput = sanitize(userInput);
const compiledTemplate = handlebars.compile(template);
const renderedOutput = compiledTemplate({ user: { name: sanitizedInput } });
console.log(renderedOutput);
Conclusion
The Prototype Pollution vulnerability in handlebars can have severe security implications for applications using affected versions. It is crucial to upgrade to handlebars 4.7.7 or later to mitigate the risk. If immediate upgrade is not possible, sanitizing and validating user input can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for handlebars →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker is able to modify the prototype of an object, leading to unexpected behavior or security issues.
The Prototype Pollution vulnerability in handlebars can allow an attacker to modify the behavior of handlebars templates, potentially leading to remote code execution, denial of service, or information disclosure.
No, only versions of handlebars prior to 4.7.7 are affected. It is recommended to upgrade to the latest version to mitigate the risk.
Yes, the fix for the Prototype Pollution vulnerability in handlebars is included in version 4.7.7. Developers should update their package.json file and install the latest version of handlebars.
Yes, sanitizing and validating user-supplied input before passing it to handlebars.compile() can help mitigate the risk of Prototype Pollution. However, upgrading to the latest version of handlebars is still recommended.
Related vulnerabilities
Recent vulnerabilities recorded for handlebars.
