Patchwire CVEs, their patch status, and feeds to follow them

CVE-2019-20920

Fixed in a distro release EPSS 3%

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Published 2020-09-30 · CVE record · OSV

Products: handlebarsjs handlebars

Fixed upstream

EcosystemPackageFixed in
npmhandlebars3.0.8
npmhandlebars4.5.3

Distro releases

ReleasePackageFixed in
Chainguardcode-server0
Chainguardcode-server-compat0
Chainguardcommercial-gitlab-rails-ee-assets-19.1no fix
Chainguardcommercial-gitlab-rails-ee-assets-19.20
Chainguardcommercial-gitlab-rails-ee-assets-19.30
Chainguardcommercial-gitlab-rails-ee-assets-19.40
Chainguardcommercial-gitlab-rails-ee-assets-19.5no fix
Chainguardcommercial-gitlab-rails-ee-assets-fips-19.1no fix
Chainguardcommercial-gitlab-rails-ee-assets-fips-19.20
Chainguardcommercial-gitlab-rails-ee-assets-fips-19.30
Chainguardcommercial-gitlab-rails-ee-assets-fips-19.40
Chainguardcommercial-gitlab-rails-ee-assets-fips-19.5no fix
Chainguardgitlab-rails-ce-18.10
Chainguardgitlab-rails-ce-18.20
Chainguardgitlab-rails-ce-18.30
Chainguardgitlab-rails-ce-18.40
Chainguardgitlab-rails-ce-18.50
Chainguardgitlab-rails-ce-18.60
Chainguardgitlab-rails-ce-18.70
Chainguardgitlab-rails-ce-assets-18.10
Chainguardgitlab-rails-ce-assets-18.100
Chainguardgitlab-rails-ce-assets-18.110
Chainguardgitlab-rails-ce-assets-18.20
Chainguardgitlab-rails-ce-assets-18.30
Chainguardgitlab-rails-ce-assets-18.40
Chainguardgitlab-rails-ce-assets-18.50
Chainguardgitlab-rails-ce-assets-18.60
Chainguardgitlab-rails-ce-assets-18.70
Chainguardgitlab-rails-ce-assets-18.80
Chainguardgitlab-rails-ce-assets-18.90
Chainguardgitlab-rails-ce-assets-19.00
Chainguardgitlab-rails-ce-assets-19.10
Chainguardgitlab-rails-ce-assets-19.20
Chainguardgitlab-rails-ce-assets-19.30
Chainguardgitlab-rails-ce-assets-19.40
Chainguardgitlab-rails-ce-assets-19.50
Chainguardgitlab-rails-ce-assets-fips-18.10
Chainguardgitlab-rails-ce-assets-fips-18.100
Chainguardgitlab-rails-ce-assets-fips-18.110
Chainguardgitlab-rails-ce-assets-fips-18.20
Chainguardgitlab-rails-ce-assets-fips-18.30
Chainguardgitlab-rails-ce-assets-fips-18.40
Chainguardgitlab-rails-ce-assets-fips-18.50
Chainguardgitlab-rails-ce-assets-fips-18.60
Chainguardgitlab-rails-ce-assets-fips-18.70
Chainguardgitlab-rails-ce-assets-fips-18.80
Chainguardgitlab-rails-ce-assets-fips-18.90
Chainguardgitlab-rails-ce-assets-fips-19.00
Chainguardgitlab-rails-ce-assets-fips-19.10
Chainguardgitlab-rails-ce-assets-fips-19.20
Chainguardgitlab-rails-ce-assets-fips-19.30
Chainguardgitlab-rails-ce-assets-fips-19.419.4.0-r1
Chainguardgitlab-rails-ce-doc-18.10
Chainguardgitlab-rails-ce-doc-18.20
Chainguardgitlab-rails-ce-doc-18.30
Chainguardgitlab-rails-ce-doc-18.40
Chainguardgitlab-rails-ce-doc-18.50
Chainguardgitlab-rails-ce-doc-18.60
Chainguardgitlab-rails-ce-doc-18.70
Chainguardgitlab-rails-ce-doc-fips-18.10
Chainguardgitlab-rails-ce-doc-fips-18.20
Chainguardgitlab-rails-ce-doc-fips-18.30
Chainguardgitlab-rails-ce-doc-fips-18.40
Chainguardgitlab-rails-ce-doc-fips-18.50
Chainguardgitlab-rails-ce-doc-fips-18.60
Chainguardgitlab-rails-ce-doc-fips-18.70
Chainguardgitlab-rails-ce-fips-18.10
Chainguardgitlab-rails-ce-fips-18.20
Chainguardgitlab-rails-ce-fips-18.30
Chainguardgitlab-rails-ce-fips-18.40
Chainguardgitlab-rails-ce-fips-18.50
Chainguardgitlab-rails-ce-fips-18.60
Chainguardgitlab-rails-ce-fips-18.70
Debian 12node-handlebars3:4.5.3-1
Debian 13node-handlebars3:4.5.3-1
Debian 14node-handlebars3:4.5.3-1
Red Hat rhev manager 4.4 el8ovirt-engine0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-backend0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-dbscripts0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-health-check-bundler0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-restapi0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup-base0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup-plugin-cinderlib0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup-plugin-imageio0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup-plugin-ovirt-engine0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup-plugin-ovirt-engine-common0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup-plugin-vmconsole-proxy-helper0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-setup-plugin-websocket-proxy0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-tools0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-tools-backup0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-vmconsole-proxy-helper0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-webadmin-portal0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-engine-websocket-proxy0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8ovirt-web-ui0:1.6.5-1.el8ev
Red Hat rhev manager 4.4 el8python3-ovirt-engine-lib0:4.4.3.8-0.1.el8ev
Red Hat rhev manager 4.4 el8rhvm0:4.4.3.8-0.1.el8ev
Ubuntu 18.04 LTSnode-handlebarsno fix
Wolficode-server0
Wolficode-server-compat0