StackRadar

CVE-2021-23369

Critical

Advisory

Published 6 May 2021In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.070
94th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
33
of 17,781 indexed, latest versions
Container images
27
deployed by those charts
Fix available
2 of 2
affected packages

Remote code execution in handlebars when compiling templates

Carried by container images the latest versions of 33 of 17,781 indexed charts deploy, on 27 images.

Affected packageAffected versionsFixed inImages
handlebarsnpm1.0.0, 1.39.1-prel, 2.0.0, 4.0.6+9 more4.7.726
handlebarsmaven4.7.64.7.71
OSV records
GHSA-f2jv-r9rf-7988

Charts affected

33 by stars
ChartLatestAffected imagesRadar Score
code-serverdeploy-code-server1.0.31 of 2See more

code-server deploy-code-server 1.0.3

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
codercom/code-server:3.10.247605610ad8d
handlebars@1.0.0
4.7.7

Open the chart page →

4,577
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
handlebars@4.1.2
4.7.7

Open the chart page →

30,326
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
handlebars@4.7.6
4.7.7

Open the chart page →

8,213
code-serveralekcVerified publisher0.1.11 of 1See more

code-server alekc 0.1.1

1 of the 1 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
linuxserver/code-server:4.10.1a5e43a05ae79
handlebars@1.0.0
4.7.7

Open the chart page →

8,212
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
handlebars@4.0.10
4.7.7

Open the chart page →

5,209
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
handlebars@4.5.3
4.7.7

Open the chart page →

6,868
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
handlebars@4.7.6
4.7.7

Open the chart page →

17,896
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
handlebars@4.7.6
4.7.7

Open the chart page →

10,730
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
handlebars@1.0.0
4.7.7

Open the chart page →

31,844
shinyproxyremche0.6.61 of 2See more

shinyproxy remche 0.6.6

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
remche/shinyproxy:2.6.18bcda8a04d3b
handlebars@4.7.6
4.7.7

Open the chart page →

3,958
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
handlebars@4.0.10
4.7.7

Open the chart page →

18,277
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
handlebars@4.7.6
4.7.7

Open the chart page →

5,806
registry-uibryanalves0.2.01 of 1See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
konradkleine/docker-registry-frontend:v2181aad54ee64
handlebars@2.0.0
4.7.7

Open the chart page →

4,069
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
handlebars@4.0.12
4.7.7

Open the chart page →

29,901
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
handlebars@4.7.3
4.7.7

Open the chart page →

25,456
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
handlebars@1.0.0
4.7.7

Open the chart page →

14,559
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
handlebars@4.0.10
4.7.7

Open the chart page →

5,209
mergeabledoubanVerified publisher0.2.21 of 1See more

mergeable douban 0.2.2

1 of the 1 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
ghcr.io/leoquote/mergeable:latest451706815103
handlebars@4.7.6
4.7.7

Open the chart page →

4,223
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
amundsendev/amundsen-frontend:2.1.169e7915e61c1
handlebars@4.5.3
4.7.7

Open the chart page →

11,174
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
handlebars@1.39.1-prel
4.7.7

Open the chart page →

22,512
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
handlebars@1.39.1-prel
4.7.7

Open the chart page →

24,319
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
handlebars@4.7.6
4.7.7

Open the chart page →

8,213
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
handlebars@4.1.2
4.7.7

Open the chart page →

32,915
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
handlebars@4.0.11
4.7.7

Open the chart page →

57,669
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
handlebars@4.0.6
4.7.7

Open the chart page →

4,614
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
handlebars@4.3.5
4.7.7

Open the chart page →

7,929
monocularmonocular1.4.152 of 5See more

monocular monocular 1.4.15

2 of the 5 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
handlebars@4.0.6
4.7.7
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
handlebars@4.0.10
4.7.7

Open the chart page →

7,048
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
handlebars@4.7.6
4.7.7

Open the chart page →

6,684
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
handlebars@4.7.6
4.7.7

Open the chart page →

27,465
hive-selfservice-ui-nodeory0.1.01 of 1See more

hive-selfservice-ui-node ory 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
oryd/hive-selfservice-ui-node:v0.0.426347ef0a2de
handlebars@4.4.5
4.7.7

Open the chart page →

1,986
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
handlebars@4.5.3
4.7.7

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
handlebars@4.5.3
4.7.7

Open the chart page →

12,460
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2021-23369.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
handlebars@4.7.6
4.7.7

Open the chart page →

5,806

Container images carrying it

27 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
pantsel/konga:latestc8172b75607d
handlebars@4.0.10
4.7.7
3
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
handlebars@4.7.6
4.7.7
2
governify/assets-manager:v1.4.12987672448c7
handlebars@1.39.1-prel
4.7.7
2
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
handlebars@4.5.3
4.7.7
2
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
handlebars@4.7.6
4.7.7
2
migmartri/prerender:latest486aacfd5aa9
handlebars@4.0.6
4.7.7
2
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
handlebars@4.3.5
4.7.7
1
amundsendev/amundsen-frontend:2.1.169e7915e61c1
handlebars@4.5.3
4.7.7
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
handlebars@4.7.6
4.7.7
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
handlebars@4.7.6
4.7.7
1
codercom/code-server:4.11.0-debian1e2cc688008e
handlebars@1.0.0
4.7.7
1
codercom/code-server:3.10.247605610ad8d
handlebars@1.0.0
4.7.7
1
daskdev/dask-notebook:1.1.0052630f5ca04
handlebars@4.0.12
4.7.7
1
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
handlebars@4.5.3
4.7.7
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
handlebars@4.1.2
4.7.7
1
ibmcom/app-nav-ui:1.0.1e2a86997b36b
handlebars@4.1.2
4.7.7
1
ibmcom/microclimate-portal:latested5505e5c7ec
handlebars@4.0.11
4.7.7
1
konradkleine/docker-registry-frontend:v2181aad54ee64
handlebars@2.0.0
4.7.7
1
linuxserver/code-server:4.10.1a5e43a05ae79
handlebars@1.0.0
4.7.7
1
linuxserver/codimd:latestb801bbcf6386
handlebars@4.7.6
4.7.7
1
mozilla/sentencecollector:2.0.91da6ff5c4895
handlebars@4.7.6
4.7.7
1
oryd/hive-selfservice-ui-node:v0.0.426347ef0a2de
handlebars@4.4.5
4.7.7
1
remche/shinyproxy:2.6.18bcda8a04d3b
handlebars@4.7.6
4.7.7
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
handlebars@1.0.0
4.7.7
1
ghcr.io/leoquote/mergeable:latest451706815103
handlebars@4.7.6
4.7.7
1
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
handlebars@4.0.10
4.7.7
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
handlebars@4.7.3
4.7.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.