---
id: CVE-2021-23383
title: >-
  The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when
  selecting certain compiling options to compile templates coming from an
  untrusted source.
summary: >-
  The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when
  selecting certain compiling options to compile templates coming from an
  untrusted source.
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-1321
  - CWE-94
vendor: handlebarsjs
product: handlebars
affected:
  - handlebars < 4.7.7
  - e-series_performance_analyzer
patched:
  - handlebars 4.7.7
published: '2021-05-04'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T22:17:07.820'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-23383'
references:
  - url: >-
      https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
    label: report@snyk.io
  - url: 'https://security.netapp.com/advisory/ntap-20210618-0007/'
    label: report@snyk.io
  - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031'
    label: report@snyk.io
  - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032'
    label: report@snyk.io
  - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030'
    label: report@snyk.io
  - url: 'https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029'
    label: report@snyk.io
  - url: >-
      https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20210618-0007/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23383.json
  - url: 'https://access.redhat.com/security/cve/CVE-2021-23383'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1956688'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2021-23383'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-23383'
  - url: 'https://access.redhat.com/errata/RHSA-2021:4628'
  - url: 'https://access.redhat.com/errata/RHSA-2021:4032'
  - url: 'https://access.redhat.com/errata/RHSA-2021:2500'
  - url: 'https://access.redhat.com/errata/RHSA-2023:1334'
tags:
  - nvd
  - exploit-available
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.04506
epssPercentile: 0.91536
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/dn9uy3n/Check-CVE-2021-23383'
    - 'https://github.com/fazilbaig1/CVE-2021-23383'
  checkedAt: '2026-11-05T15:09:09.881Z'
exploitAvailable: true
ingestedAt: '2026-10-08T23:16:47.318Z'
scores:
  nvd: 5.6
  vendor: 9.8
  cna: 5.6
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-08T21:03:53.835330Z'
---

## Overview

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

## Affected

- `handlebars < 4.7.7`
- `e-series_performance_analyzer`

## Remediation

Upgrade past the affected range:

- `handlebars 4.7.7`

## Vendor advisories

- **RHSA-2021:4628** · Red Hat · fixed in: OpenShift Logging 5.1 · released 2021-11-17 · [advisory](https://access.redhat.com/errata/RHSA-2021:4628)
- **RHSA-2021:4032** · Red Hat · fixed in: OpenShift Logging 5.2 · released 2021-11-17 · [advisory](https://access.redhat.com/errata/RHSA-2021:4032)
- **RHSA-2021:2500** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.6 · released 2021-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2021:2500)
- **RHSA-2023:1334** · Red Hat · fixed in: RHPAM 7.13.1 async · released 2023-03-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:1334)
- **Red Hat VEX** · Moderate · affected: OpenShift Service Mesh 2.0, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 3.11, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 8, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23383.json)