GHSA-6r5x-hmgg-7h53
Remote code execution in Handlebars.js
Medium
Withdrawn Jul 15, 2019
npm
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
4.1.0- Upgrade handlebars to this version or later
Description
Handlebars.js before 4.1.0 has Remote Code Execution (RCE)
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| handlebars | < 4.1.0 |
4.1.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
handlebars npm → 4.1.0
- npm
npm install handlebars@4.1.0- yarn
yarn add handlebars@4.1.0- pnpm
pnpm add handlebars@4.1.0
References
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8r5x-fm3f-whwj Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) | Critical | Also affects handlebars |
| GHSA-p8wg-vrv2-v86f Handlebars: JavaScript Injection via Own Property Check Bypass | Critical | Also affects handlebars |
| GHSA-xw65-4hp5-5hc7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | Medium | Also affects handlebars |
| GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry | Medium | Also affects handlebars |
| GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup | Low | Also affects handlebars |
| GHSA-xjpj-3mr7-gcpf Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | High | Also affects handlebars |
| GHSA-xhpv-hc6g-r9c6 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | High | Also affects handlebars |
| GHSA-9cx6-37pm-9jff Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | High | Also affects handlebars |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor