Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to ru…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2019-20920 · Microsoft / collected KEV context

EUVD-2022-0789

GHSA-3cqr-58rm-57f8

SNYK-JS-HANDLEBARS-534478

cve-program · CVE-2019-20920

• https://www.npmjs.com/advisories/1316
• https://www.npmjs.com/advisories/1324
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478

euvd · EUVD-2022-0789

• https://www.npmjs.com/advisories/1316
• https://www.npmjs.com/advisories/1324
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478

nvd · CVE-2019-20920

• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478
• https://www.npmjs.com/advisories/1316
• https://www.npmjs.com/advisories/1324

osv · GHSA-3cqr-58rm-57f8

• https://nvd.nist.gov/vuln/detail/CVE-2019-20920
• https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee
• https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478
• https://www.npmjs.com/advisories/1316
• https://www.npmjs.com/advisories/1324
• https://www.npmjs.com/package/handlebars

No related operational record is retained in the current change model.