CVE-2021-23369

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Apr 12, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-23377.2Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.CVE-2021-233709.8This affects the package swiper before 6.5.1.CVE-2021-233717.5This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.CVE-2021-233727.5All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandl CVE-2021-233739.8All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.CVE-2021-233749.8This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an atta CVE-2021-233759.8This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker CVE-2021-233769.8This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for a CVE-2021-233779.8This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an CVE-2021-233789.8This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker CVE-2021-233799.8This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arb CVE-2021-23386.1Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing Stand-Alone). Supported versions that