CVE-2019-20920: Code Injection
A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to arbitrary code execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript into the system. This issue is used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting). The highest threat from this vulnerability is to confidentiality.
Other sources
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).
References:
https://www.npmjs.com/advisories/1316 https://www.npmjs.com/advisories/1324
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20920?
CVE-2019-20920 is a vulnerability in Handlebars that allows arbitrary code execution.
What is the severity of CVE-2019-20920?
The severity of CVE-2019-20920 is high with a CVSS score of 8.1.
How does CVE-2019-20920 work?
CVE-2019-20920 allows attackers to execute arbitrary JavaScript code by exploiting the improper validation of templates in Handlebars.
Which versions of Handlebars are affected by CVE-2019-20920?
Handlebars versions before 3.0.8 and 4.x before 4.5.3 are affected by CVE-2019-20920.
How can I fix CVE-2019-20920?
To fix CVE-2019-20920, update to version 4.5.3 if you are using Handlebars 4.x, or update to version 3.0.8 if you are using Handlebars 3.x.