CVE-2019-20920

Name of the Vulnerable Software and Affected Versions Handlebars versions prior to 3.0.8 Handlebars versions 4.x prior to 4.5.3

Description The issue allows attackers to execute arbitrary JavaScript code by submitting templates that are not properly validated by the lookup helper. This can lead to arbitrary code execution on a server that processes Handlebars templates or in a victim's browser, effectively serving as a cross-site scripting (XSS) attack.

Recommendations For Handlebars versions prior to 3.0.8, update to version 3.0.8 or later. For Handlebars versions 4.x prior to 4.5.3, update to version 4.5.3 or later.