VDB
GHSA-7rx3-28cr-v5wh
GHSA-7rx3-28cr-v5wh
PUBLISHED
CVSS 4.800000190734863 MEDIUM
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
Risk Scores
CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | gitlab-rails-ce-fips-19.0 | 0, 0, 0 |
| chainguard | kibana-9.1 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-19.1 | 0, 0, 0 |
| chainguard | opensearch-dashboards-3 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-19.0 | 0, 0, 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0, 0, 0 |
| chainguard | prism | 0, 0, 0 |
| wolfi | lerna | 0, 0, 0 |
| chainguard | kibana-9.2 | 0, 0, 0 |
| wolfi | opensearch-dashboards-3 | 0, 0, 0 |
| wolfi | nextcloud-server-32 | 0, 0, 0 |
| chainguard | pelias-api | 0, 0, 0 |
| chainguard | gitlab-rails-ce-18.11 | 0, 0, 0 |
| chainguard | nextcloud-server-32 | 0, 0, 0 |
| chainguard | opensearch-dashboards-2-fips | 0, 0, 0 |
| handlebars-lang | handlebars.js | |
| chainguard | kibana-8.17 | 0, 0, 0 |
| chainguard | wazuh-dashboard | 0, 0, 0 |
| chainguard | kibana-8.18 | 0, 0, 0 |
| chainguard | tensorflow-cpu-jupyter | 0, 0, 0 |
…and 20 more
Timeline
- Mar 29, 2026 CVE Published
- Mar 31, 2026 Security Advisory
References
- https://github.com/handlebars-lang/handlebars.js package
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh url
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 url
- GitHub Advisory GHSA-765h-qjxv-5f44 vendor-advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032 url
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030 url
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/handlebars-source/CVE-2021-23383.yml url
- https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427 url
- https://www.npmjs.com/package/handlebars url
- https://security.netapp.com/advisory/ntap-20210618-0007 url
- https://nvd.nist.gov/vuln/detail/CVE-2021-23383 advisory
- Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031 url
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029 url