{"id":"CVE-2021-23383","published":"2021-05-04T08:35:21Z","modified":"2026-10-08T21:13:46Z","title":"Prototype Pollution","vendor":null,"product":null,"tier":"tail","description":{"text":"The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04506,"percentile":0.91486,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210618-0007/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":27.2,"factors":[{"name":"EPSS percentile","points":18.3},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.92}]},"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2021-06-28","earliestUrl":"https://github.com/dn9uy3n/Check-CVE-2021-23383","repos":[{"name":"fazilbaig1/CVE-2021-23383","url":"https://github.com/fazilbaig1/CVE-2021-23383","stars":2,"created":"2024-10-19"},{"name":"dn9uy3n/Check-CVE-2021-23383","url":"https://github.com/dn9uy3n/Check-CVE-2021-23383","stars":1,"created":"2021-06-28"}]},"first":{"date":"2021-06-28","source":"PoC-in-GitHub","url":"https://github.com/dn9uy3n/Check-CVE-2021-23383"},"provenance":"source"},"affectedVersions":[{"vendor":"n/a","product":"handlebars","versions":[">= unspecified, < 4.7.7"]}],"affected":[{"ecosystem":"npm","package":"handlebars","vulnerableRanges":["<4.7.7"],"patched":["4.7.7"],"from":["GHSA-765h-qjxv-5f44"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0882","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-handlebars-lang-handlebars-js-cve-2021-23369","children":[{"from":"CVE-2021-23383","to":"CVE-2026-33916","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-2qvq-rjwj-gvw9","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23383"}]}],"packageHistory":[{"cve":"CVE-2019-20922","published":"2020-09-30","fixed":"4.4.5","kev":false},{"cve":"CVE-2019-20920","published":"2020-09-30","fixed":"4.5.3","kev":false,"link":{"from":"CVE-2019-20920","to":"CVE-2021-23383","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:handlebars","fromFixed":"4.5.3","toFixed":"4.7.7","daysApart":216},{"kind":"same-code","provenance":"machine","files":["lib/handlebars/compiler/javascript-compiler.js"],"commits":["https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee","https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e","https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427"],"basis":"shared file"}]}},{"cve":"CVE-2021-23369","published":"2021-04-12","fixed":"4.7.7","kev":false},{"cve":"CVE-2021-23383","published":"2021-05-04","fixed":"4.7.7","kev":false},{"cve":"CVE-2026-33916","published":"2026-03-27","fixed":"4.7.9","kev":false},{"cve":"CVE-2026-33937","published":"2026-03-27","fixed":"4.7.9","kev":false},{"cve":"CVE-2026-33938","published":"2026-03-27","fixed":"4.7.9","kev":false}],"package":"npm:handlebars"}}