Login Request a demo
HA
Product
handlebars.js
by handlebars-lang · last CVE Oct 6, 2026
9
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 3High 4Medium 2Low 0
Severity
All severities9Critical3High4Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add handlebars.js to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-106446
9.8
1%
Oct 6
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
Affected: >= 4.0.0, < 4.7.10
CVE-2026-33937
9.8
2%
Mar 27
Handlebars.js has JavaScript Injection via AST Type Confusion
Affected: >= 4.0.0, < 4.7.9
CVE-2026-106445
9.2
1%
Oct 6
Handlebars: JavaScript Injection via Own Property Check Bypass
Affected: >= 3.0.0, < 4.7.10
CVE-2026-33941
8.2
0%
Mar 27
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Affected: >= 4.0.0, < 4.7.9
CVE-2026-33940
8.1
1%
Mar 27
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Affected: >= 4.0.0, < 4.7.9
CVE-2026-33938
8.1
1%
Mar 27
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Affected: >= 4.0.0, < 4.7.9
CVE-2026-33939
7.5
1%
Mar 27
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Affected: >= 4.0.0, < 4.7.9
CVE-2026-106444
4.7
0%
Oct 6
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Affected: >= 4.0.0, < 4.7.10
CVE-2026-33916
4.7
0%
Mar 27
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Affected: >= 4.0.0, < 4.7.9
Showing 9