Vulnerabilities

TI-2026-26292 CVE-2026-33941 · GHSA-xjpj-3mr7-gcpf

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

HIGH 71

Handlebars provides the power necessary to let users build semantic templates.

CVSS 3.1HIGH 8.3 Local Low privileges User interaction EPSS 0.00296 Published 2026-03-27 Partial fix · 4.7.9 CWE-116

TI-2026-26291 CVE-2026-33940 · GHSA-xhpv-hc6g-r9c6

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

HIGH 70

Handlebars provides the power necessary to let users build semantic templates.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00715 Published 2026-03-27 Partial fix · 4.7.9 CWE-843

TI-2026-26290 CVE-2026-33939 · GHSA-9cx6-37pm-9jff

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

HIGH 72

Handlebars provides the power necessary to let users build semantic templates.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00627 Published 2026-03-27 Partial fix · 4.7.9 CWE-754

TI-2026-26289 CVE-2026-33938 · GHSA-3mfm-83xf-c92r

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

HIGH 70

Handlebars provides the power necessary to let users build semantic templates.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00721 Published 2026-03-27 Partial fix · 4.7.9 CWE-843

TI-2026-26288 CVE-2026-33937 · GHSA-2w6w-674q-4c4q

Handlebars.js has JavaScript Injection via AST Type Confusion

HIGH 82

Handlebars provides the power necessary to let users build semantic templates.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01907 Published 2026-03-27 Partial fix · 4.7.9 CWE-843

TI-2026-26274 CVE-2026-33916 · GHSA-2qvq-rjwj-gvw9

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

MEDIUM 55

Handlebars provides the power necessary to let users build semantic templates.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.0028 Published 2026-03-27 Partial fix · 4.7.9 CWE-1321

TI-2021-06076 CVE-2021-23383 · GHSA-765h-qjxv-5f44

Prototype pollution in handlebars

MEDIUM 56

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04506 Published 2021-05-04 Partial fix · 4.7.7 CWE-1321

TI-2021-06062 CVE-2021-23369 · GHSA-f2jv-r9rf-7988

Remote code execution (RCE) in handlebars

MEDIUM 59

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07028 Published 2021-04-12 Partial fix · 4.7.7 CWE-94

TI-2019-15134 CVE-2019-20920 · GHSA-3cqr-58rm-57f8

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.

MEDIUM 47

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.03154 Published 2020-09-30 Partial fix · 3.0.8, 4.5.3 CWE-94

TI-2019-15136 CVE-2019-20922 · GHSA-62gr-4qp9-h98f

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of…

LOW 39

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03691 Published 2020-09-30 Partial fix · 4.4.5 CWE-400

Vulnerabilities

Filters