by Kastro
Paper/Archive/CVE-2021-23369

CVE-2021-23369

snyk — Remote Code Execution (RCE)

EPSS 7%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.2.942 × 2018.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Affected

ProductAffectedFixed inSource
handlebarsunspecified – < 4.7.74.7.7CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsnyk.io/vuln/SNYK-JS-HANDLEBARS-1056767refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952refgithub.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8refgithub.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427refsecurity.netapp.com/advisory/ntap-20210604-0008