CVE-2019-20920
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
- CVSS 3.1
- 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L - EPSS
- 3.2% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-25)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- handlebarsjs:handlebars
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3cqr-58rm-57f8 | npm | handlebars | <3.0.8 | 3.0.8 |
| GHSA-3cqr-58rm-57f8 | npm | handlebars | >=4.0.0 <4.5.3 | 4.5.3 |