{"id":"CVE-2019-20920","revision":"c27d1c40340f4cd29bc055622a1ce5fc","records":[{"revision":"c27d1c40340f4cd29bc055622a1ce5fc","observedAt":"2026-10-24T15:17:33.973+00:00","statement":{"source":"nvd","id":"CVE-2019-20920","aliases":[],"title":"Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to ru…","description":"Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).","state":0,"publishedAt":"2020-09-30T18:15:17.927+00:00","modifiedAt":"2026-10-08T22:16:54.603+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","score":8.1,"severity":"HIGH"},{"system":"CVSS 2.0 · nvd@nist.gov · Primary","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","score":6.8,"severity":"MEDIUM"}],"references":["https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478","https://www.npmjs.com/advisories/1316","https://www.npmjs.com/advisories/1324"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-20920","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-94"],"productCriteria":["cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2020-09-30T18:15:17.927","lastModified":"2026-10-08T22:16:54.603"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2019-20920","identifiers":["CVE-2019-20920"]},"retained":false,"historicalAffected":[]}],"coverage":[]}