CVE-2021-23383: handlebarsjs handlebars Prototype Pollution
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2021-23383DEBIAN-CVE-2021-23383CGA-37wr-4cfq-65jqCGA-cvv5-5h49-2jf2CGA-w52p-v2qr-6g25CGA-xmr7-jjqj-c8j2GHSA-765h-qjxv-5f44CGA-25hc-88m5-6cxvCGA-28vf-9q2x-f439CGA-2fc8-fr49-m7cmCGA-2hc2-jg5q-6qpvCGA-2wcr-p643-m9v5CGA-2xj9-wcxw-7rq5CGA-33w3-x6wc-22pcCGA-357g-7rhw-mgpwCGA-362j-f23c-w2j6CGA-3c33-ffq6-fgf2CGA-3jm3-9chf-h2h4CGA-3qgc-vhvv-g2q2CGA-44f9-v9h6-xpgmCGA-456f-9hgq-fw2vCGA-45gh-57jw-q3mcCGA-4629-3362-phvgCGA-4mpr-53h5-x339CGA-4qmm-g6fx-45mgCGA-4wc8-3jp3-p67mCGA-542v-xxc9-xw7vCGA-5gjh-4mg5-qx2gCGA-5gxv-pg29-h429CGA-5qq4-7p6x-5cx5CGA-5wvh-jc49-3gxvCGA-6265-g6v9-q274CGA-64m7-8fh5-gf54CGA-65mg-v5xr-3w3mCGA-67rh-5f6x-v62hCGA-6c3g-vrw7-8738CGA-6gx4-fqxh-5982CGA-6j5j-v28v-jx7rCGA-6mrx-6649-rm29CGA-6rcf-vwc5-rc7xCGA-6rxp-mpg7-ppmwCGA-7c45-ggc7-8mmjCGA-7c65-mj2q-9f4vCGA-7f87-7r4h-cr5jCGA-7fvw-mr2v-gj8hCGA-7g82-rxf6-qv3wCGA-7p42-gj43-mvw9CGA-7q7q-22hw-729rCGA-7rvw-8wmj-4hx3CGA-7v7f-qjvh-cc3xCGA-863f-jwmr-ghfcCGA-899j-mc78-4mmqCGA-8cg8-683q-hwwwCGA-8m78-5g8v-wq37CGA-8pg9-65fh-9fhrCGA-979v-5965-w779CGA-98m3-78w2-83mrCGA-99rf-2j64-p9wcCGA-9c5h-v2rj-gg2cCGA-9fhx-37p9-wfrxCGA-9hh8-7vpr-c8cjCGA-9m5w-v4m8-g3cvCGA-9m7x-q55w-j6wmCGA-9qpf-gqgm-pv92CGA-cg62-m6fj-p467CGA-cq96-3xgr-jf6vCGA-cr73-fwhf-ffxgCGA-cxh8-vmmc-jvj7CGA-cxpp-c67q-mv9wCGA-f23h-vpxw-jf52CGA-f2vv-9j6f-m9h9CGA-f6v2-grp2-c2ghCGA-f98m-3cmg-v425CGA-fgj8-45pj-rhp3CGA-g39w-42p6-fx3hCGA-g3hv-v752-rw4jCGA-g44g-xr2v-vv9qCGA-g52v-8h7q-whv9CGA-g6pf-fw33-j63mCGA-g72f-cr26-4cg4CGA-g7mp-545r-8588CGA-g98c-8jm6-vfx6CGA-g9rq-gqph-3fc7CGA-gghr-p452-xr5hCGA-gv89-cxr8-435wCGA-gvhv-q3gg-ff7xCGA-gvp7-8272-v6xwCGA-h2mc-59r9-3q4vCGA-hfh5-pqgr-vf4pCGA-hg93-rvcc-g7pxCGA-hgrv-775x-mc2rCGA-hj28-pv2j-395wCGA-hpmq-wqg6-66f8CGA-hxcp-7xhc-gvvrCGA-j224-p2pr-wgw4CGA-j462-xr5r-jr2cCGA-jvmr-6fjg-364xCGA-m4fr-qhr8-vmqmCGA-m796-3532-4m78CGA-mcgx-gfgw-mxgpCGA-mf2r-p9qq-7phxCGA-mfrw-4wq3-5q3hCGA-mpj4-prqf-3g7qCGA-mpj8-7rcw-hv76CGA-mpv9-g4mr-hjqrCGA-p3hf-2jwh-xfmvCGA-p58c-pvcf-9qqqCGA-p5g5-qjx4-pcvvCGA-p852-8jpf-cqfvCGA-p8c9-fw9v-vmgxCGA-p947-8pgc-h98jCGA-pcgg-6w29-cr23CGA-pgjf-r2fm-jgr5CGA-ph7p-5v2j-2wcrCGA-qhrh-65gj-3cv4CGA-rchc-xhg7-vv83CGA-x394-9hwj-32hcCGA-x6xf-g3wv-8wx6CGA-pw95-54rm-2p49CGA-q396-jqx7-mh6rCGA-q9hr-mc2q-7fvvCGA-qvhv-7r8p-v6g5CGA-qx37-v7mq-3388CGA-r34r-hfx6-mq86CGA-r3vc-gc5p-h97wCGA-r544-fqm6-8fqhCGA-rfv7-84fr-jpc5CGA-rhqw-f5hm-3jx2CGA-rm66-vf27-x838CGA-rpj4-rprx-6h5xCGA-rqhx-h8qc-r548CGA-rr3g-qr3q-xp5xCGA-rv6p-2x42-p55pCGA-rvw7-w2q9-mjxfCGA-v2wg-p8pg-h5w4CGA-v394-mvv2-xg8wCGA-v576-7rhq-x8gfCGA-v5j8-43c7-rw77CGA-v883-v2vq-hr59CGA-vprf-vhhh-37cfCGA-vrv5-6vvm-hv47CGA-w33p-xff7-7j79CGA-w5v3-7r83-4cfmCGA-wjfw-hr96-973wCGA-wq5x-93vv-pf5pCGA-wvc9-q2hq-c529CGA-wxw6-6v66-vv5cCGA-x24p-4xjq-5j62CGA-x2v5-4v27-xvwhCGA-x389-xjjp-6p5gCGA-x55j-rxj4-p9fgCGA-xc29-h5rq-55vjCGA-xj3h-mc5j-pwppCGA-xv5q-jwh5-m2hfCGA-xvh5-7g5v-hjq9CGA-2gq5-qxgm-wr9mCGA-94q6-79xc-vfwv
Published 04-05-2021Last modified 08-10-2026
Vulnerability summary
CVE-2021-23383 is a critical (CVSS 9.8) Prototype Pollution vulnerability in handlebarsjs handlebars. EPSS estimates a 4.51% chance of exploitation in the next 30 days, higher than 91.3% of scored vulnerabilities. 4 public exploits are recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
4.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits4reference
Advisory lineage
Upstream 0 · Downstream 0 · Related 11Timeline
- 04-05-2021PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
CVSS metrics
8 scores · 7 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources7 sources · 5.6–9.8
- CVE.orgCNA5.6MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:CDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.51%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.51% on 18-09-2026
18-09-202618-10-2026
EPSS score4.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Exploit Reference (snyk.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard71 products
- code-serverAll versions (No fix recorded)
- code-server-compatAll versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.2All versions (No fix recorded)
- commercial-gitlab-rails-ee-assets-19.3All versions (No fix recorded)
Wolfi2 products
- code-serverAll versions (No fix recorded)
- code-server-compatAll versions (No fix recorded)
Debian1 product
- node-handlebars< 3:4.7.6+~4.1.0-2
Handlebarsjs1 product
- handlebars< 4.7.7
Netapp1 product
Npm1 product
- handlebars< 4.7.7
Ubuntu1 product
- node-handlebarsAll versions (No fix recorded)
7 vendors · 78 products
References
14 links- github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427X Refsource MISCREPORTFIXWEBPatchThird Party Advisory
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030X Refsource MISCREPORTFIXWEBExploitPatchThird Party Advisory
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031X Refsource MISCREPORTFIXWEBExploitPatchThird Party Advisory
- snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032X Refsource MISCREPORTFIXWEBExploitPatchThird Party Advisory
