CVE-2021-23369 : faille critique handlebarsjs handlebars (CVSS 9.8)

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Sévérité

Critique (CVSS 9.8)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation active

Non signalée par la CISA

Publication

12 avr. 2021

Dernière mise à jour

17 juin 2026

• handlebarsjs handlebars

• Fiche CVE-2021-23369 sur le NVD (NIST)
• github.com/handlebars…
• github.com/handlebars…
• security.netapp.com/advisory/ntap-20210604-0008/
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951
• snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952
• snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767