{"id":"CVE-2019-20920","sourceIdentifier":"cve@mitre.org","published":"2020-09-30T18:15:17.927","lastModified":"2026-10-08T22:16:54.603","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS)."},{"lang":"es","value":"Handlebars versiones anteriores a 3.0.8 y versiones 4.x anteriores a 4.5.3, son vulnerables a una ejecución de código arbitraria. El asistente de búsqueda no comprueba apropiadamente las plantillas, permitiendo a atacantes enviar plantillas que ejecutan JavaScript arbitrario. Esto se puede ser usado  para ejecutar código arbitrario en un servidor que procesa las plantillas de Handlebars o en el navegador de una víctima (que sirve efectivamente como un XSS)"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":5.3}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T21:08:21.157256Z","id":"CVE-2019-20920","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*","versionEndExcluding":"3.0.8","matchCriteriaId":"BB7C04DC-7BC4-4508-8D18-C2FB5AC8468D"},{"vulnerable":true,"criteria":"cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.5.3","matchCriteriaId":"23E88C1D-4DAA-42FC-93F6-A0ECD21482D4"}]}]}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://www.npmjs.com/advisories/1316","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.npmjs.com/advisories/1324","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.npmjs.com/advisories/1316","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.npmjs.com/advisories/1324","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}