Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-23369

33
FAUCET Score

CVE-2021-23369 is a critical Remote Code Execution (RCE) vulnerability affecting Handlebars.js versions prior to 4.7.7. It allows an attacker to execute arbitrary code by crafting malicious templates when specific compilation options are used with untrusted input. With a CVSS score of 9.8, this vulnerability is easily exploitable over a network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 4.7.7CPE matchmatch criteria
cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

5.6MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
Exploitability Score
2.2
Impact Score
3.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
7.03%
Probability of exploitation in next 30 days
EPSS Percentile
93.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0703 is in the 89th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (20)

github_advisorypatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: org.webjars:handlebarsFixed in: 4.7.7
mavenpatch availablevia ghsa
Product: org.webjars.npm:handlebarsFixed in: 4.7.7
mavenpatch availablevia ghsa
Product: org.webjars.bowergithub.wycats:handlebars.jsFixed in: 4.7.7
npmpatch availablevia ghsa
Product: handlebarsFixed in: 4.7.7
redhatpatch availablevia redhat_api
Product: OpenShift Logging 5.2Fixed in: openshift-logging/kibana6-rhel8:v6.8.1-47
View patch
redhatpatch availablevia redhat_api
Product: OpenShift Logging 5.1Fixed in: openshift-logging/kibana6-rhel8:v6.8.1-48
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.6Fixed in: openshift4/ose-logging-kibana6:v4.6.0-202106181629.p0.git.40f3e72
View patch
redhatpatch availablevia redhat_api
Product: RHPAM 7.13.1 asyncFixed in: handlebars
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: pcs
redhatvendor investigatingvia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat Storage 3Fixed in: pcs
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 3.11Fixed in: kibana
redhatno patchvia redhat_api
Product: OpenShift Service Mesh 2.0Fixed in: servicemesh-prometheus
redhatno patchvia redhat_api
Product: OpenShift Service Mesh 2.0Fixed in: servicemesh-grafana
redhatno patchvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/application-ui-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: kibana
redhatend of lifevia redhat_api
Product: Red Hat 3scale API Management Platform 2Fixed in: nodejs-handlebars
redhatend of lifevia redhat_api
Product: Red Hat Virtualization 4Fixed in: ovirt-engine-ui-extensions
redhatend of lifevia redhat_api
Product: Red Hat Virtualization 4Fixed in: ovirt-web-ui

Vendor Advisories (2)

npmGHSA-f2jv-r9rf-7988critical

Remote code execution in handlebars when compiling templates

May 6, 2021
redhatCVE-2021-23369Moderate

nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option

Apr 12, 2021

References

github.com / handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8
PatchThird Party Advisory
github.com / handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
PatchThird Party Advisory
security.netapp.com / advisory/ntap-20210604-0008
Third Party Advisory
snyk.io / vuln/SNYK-JAVA-ORGWEBJARS-1074950
ExploitThird Party Advisory
snyk.io / vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951
ExploitThird Party Advisory
snyk.io / vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952
ExploitThird Party Advisory
snyk.io / vuln/SNYK-JS-HANDLEBARS-1056767
ExploitThird Party Advisory