{"action":"Upgrade handlebars to 3.0.8 or later.","affected":[{"fixed":"3.0.8","introduced":"0"},{"fixed":"4.5.3","introduced":"4.0.0"}],"component":"handlebars","cve_ids":["CVE-2019-20920"],"ecosystem":"npm","epss":0.03154,"exploited":false,"fixed_versions":["3.0.8","4.5.3"],"ghsa_id":"GHSA-3cqr-58rm-57f8","id":"tcs_01M5KEX1EKNWECES9930Y42YQX","modified_at":"2026-09-10T03:49:16.886485583Z","published_at":"2022-02-10T20:38:19Z","references":["https://osv.dev/vulnerability/GHSA-3cqr-58rm-57f8","https://nvd.nist.gov/vuln/detail/CVE-2019-20920","https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee","https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e","https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478","https://www.npmjs.com/advisories/1316","https://www.npmjs.com/advisories/1324","https://www.npmjs.com/package/handlebars"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-3cqr-58rm-57f8","url":"https://osv.dev/vulnerability/GHSA-3cqr-58rm-57f8"}],"summary":"Arbitrary Code Execution in Handlebars"}