[ Vendor · 9 CVEs ]
handlebars-lang
CVEs affecting handlebars-lang published in the last 30 days, plus any handlebars-lang CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106444 | 6 Oct 2026 | CVSS 4.7 | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled TemplatesHandlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString()… | Fix |
| CVE-2026-106445 | 6 Oct 2026 | CVSS 9.2 | Handlebars: JavaScript Injection via Own Property Check BypassHandlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns… | Fix |
| CVE-2026-106446 | 6 Oct 2026 | CVSS 9.8 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and… | Fix |
| CVE-2026-33941 | 27 Mar 2026 | CVSS 8.3 | handlebars-lang handlebars.jsHandlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler… | |
| CVE-2026-33940 | 27 Mar 2026 | CVSS 8.1 | handlebars-lang handlebars.jsHandlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the… | |
| CVE-2026-33939 | 27 Mar 2026 | CVSS 7.5 | handlebars-lang handlebars.jsHandlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains… | |
| CVE-2026-33938 | 27 Mar 2026 | CVSS 8.1 | handlebars-lang handlebars.jsHandlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable… | |
| CVE-2026-33937 | 27 Mar 2026 | CVSS 9.8 | handlebars-lang handlebars.jsHandlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a… | |
| CVE-2026-33916 | 27 Mar 2026 | CVSS 4.7 | handlebars-lang handlebars.jsHandlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars… |