CVE-2021-23369
⚪ Do wiadomości
Wykonanie zdalnego kodu w Handlebars umożliwia przetwarzanie niezaufanych szablonów.
CVSS
5.6
EPSS
7.0%
Exploit
poc
Vendor
handlebarsjs
Opis źródłowy (NVD)
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
exploit rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 5.6 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 7.0% |
| Opublikowano (NVD) | 2021-04-12 14:15:14 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 22:17:07 UTC |
Referencje
- https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8 ([email protected]) [Patch, Third Party Advisory]
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 ([email protected]) [Patch, Third Party Advisory]
- https://security.netapp.com/advisory/ntap-20210604-0008/ ([email protected]) [Third Party Advisory]
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950 ([email protected]) [Exploit, Third Party Advisory]
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951 ([email protected]) [Exploit, Third Party Advisory]
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952 ([email protected]) [Exploit, Third Party Advisory]
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767 ([email protected]) [Exploit, Third Party Advisory]