TI-2026-26288 CVE-2026-33937 · GHSA-2w6w-674q-4c4q
Handlebars.js has JavaScript Injection via AST Type Confusion
Priority HIGH 82
Handlebars provides the power necessary to let users build semantic templates.
handlebars-lang
Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
handlebars-lang records in CISA KEVNo handlebars-lang vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records in Handlebars · all components
TI-2026-26290 CVE-2026-33939 · GHSA-9cx6-37pm-9jff
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Priority HIGH 72
Handlebars provides the power necessary to let users build semantic templates.
TI-2026-26292 CVE-2026-33941 · GHSA-xjpj-3mr7-gcpf
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Priority HIGH 71
Handlebars provides the power necessary to let users build semantic templates.
TI-2026-26291 CVE-2026-33940 · GHSA-xhpv-hc6g-r9c6
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Priority HIGH 70
Handlebars provides the power necessary to let users build semantic templates.
TI-2026-26289 CVE-2026-33938 · GHSA-3mfm-83xf-c92r
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Priority HIGH 70
Handlebars provides the power necessary to let users build semantic templates.
TI-2021-06062 CVE-2021-23369 · GHSA-f2jv-r9rf-7988
Remote code execution (RCE) in handlebars
Priority MEDIUM 59
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
TI-2021-06076 CVE-2021-23383 · GHSA-765h-qjxv-5f44
Prototype pollution in handlebars
Priority MEDIUM 56
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
TI-2026-26274 CVE-2026-33916 · GHSA-2qvq-rjwj-gvw9
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Priority MEDIUM 55
Handlebars provides the power necessary to let users build semantic templates.
TI-2019-15134 CVE-2019-20920 · GHSA-3cqr-58rm-57f8
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.
Priority MEDIUM 47
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.
TI-2019-15136 CVE-2019-20922 · GHSA-62gr-4qp9-h98f
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of…
Priority LOW 39
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching.