CVE-2019-20920

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

• CWE-94

• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478Third Party Advisory
• https://www.npmjs.com/advisories/1316Exploit, Third Party Advisory
• https://www.npmjs.com/advisories/1324Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478Third Party Advisory
• https://www.npmjs.com/advisories/1316Exploit, Third Party Advisory
• https://www.npmjs.com/advisories/1324Third Party Advisory

Published

Sep 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20915An issue was discovered in GNU LibreDWG through 0.9.3. Craft…8.1
• CVE-2019-20916The pip package before 19.2 for Python allows Directory Trav…7.5
• CVE-2019-20917An issue was discovered in InspIRCd 2 before 2.0.28 and 3 be…6.5
• CVE-2019-20918An issue was discovered in InspIRCd 3 before 3.1.0. The sile…6.5
• CVE-2019-20919An issue was discovered in the DBI module before 1.643 for P…4.7
• CVE-2019-2092In isSeparateProfileChallengeAllowed of DevicePolicyManagerS…
• CVE-2019-20921bootstrap-select before 1.13.6 allows Cross-Site Scripting (…6.1
• CVE-2019-20922Handlebars before 4.4.5 allows Regular Expression Denial of …7.5
• CVE-2019-20923A user authorized to perform database queries may trigger de…6.5
• CVE-2019-20924A user authorized to perform database queries may trigger de…6.5
• CVE-2019-20925An unauthenticated client can trigger denial of service by i…7.5
• CVE-2019-2093In huff_dec_1D of nlc_dec.cpp, there is a possible out of bo…