handlebars
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 22 advisory(ies) without a verdict
Advisories (22)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2cf5-4w76-r9qv Arbitrary Code Execution in handlebars | < 3.0.8 ; 4.0.0 – < 4.5.2 | Undetermined |
| GHSA-2qvq-rjwj-gvw9 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection | 4.0.0 – < 4.7.9 | Undetermined |
| GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion | 4.0.0 – < 4.7.9 | Undetermined |
| GHSA-3cqr-58rm-57f8 Arbitrary Code Execution in Handlebars | < 3.0.8 ; 4.0.0 – < 4.5.3 | Undetermined |
| GHSA-3mfm-83xf-c92r Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | 4.0.0 – < 4.7.9 | Undetermined |
| GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup | 4.0.0 – < 4.7.9 | Undetermined |
| GHSA-62gr-4qp9-h98f Regular Expression Denial of Service in Handlebars | 4.0.0 – < 4.4.5 | Undetermined |
| GHSA-765h-qjxv-5f44 Prototype Pollution in handlebars | < 4.7.7 | Undetermined |
| GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry | 4.6.0 – < 4.7.9 | Undetermined |
| GHSA-8r5x-fm3f-whwj Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) | 4.0.0 – < 4.7.10 | Undetermined |
| GHSA-9cx6-37pm-9jff Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | 4.0.0 – < 4.7.9 | Undetermined |
| GHSA-9prh-257w-9277 Cross-Site Scripting in handlebars | < 4.0.0 | Undetermined |
| GHSA-f2jv-r9rf-7988 Remote code execution in handlebars when compiling templates | < 4.7.7 | Undetermined |
| GHSA-f52g-6jhx-586p Denial of Service in handlebars | 4.0.0 – < 4.4.5 | Undetermined |
| GHSA-g9r4-xpmj-mj65 Prototype Pollution in handlebars | < 3.0.8 ; 4.0.0 – < 4.5.3 | Undetermined |
| GHSA-p8wg-vrv2-v86f Handlebars: JavaScript Injection via Own Property Check Bypass | 3.0.0 – < 4.7.10 | Undetermined |
| GHSA-q2c6-c6pm-g3gh Arbitrary Code Execution in handlebars | < 3.0.8 ; 4.0.0 – < 4.5.3 | Undetermined |
| GHSA-q42p-pg8m-cqh6 Prototype Pollution in handlebars | 4.1.0 – < 4.1.2 ; 4.0.0 – < 4.0.14 ; < 3.0.7 | Undetermined |
| GHSA-w457-6q6x-cgp9 Prototype Pollution in handlebars | 4.0.0 – < 4.3.0 ; < 3.0.8 | Undetermined |
| GHSA-xhpv-hc6g-r9c6 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | 4.0.0 – < 4.7.9 | Undetermined |
| GHSA-xjpj-3mr7-gcpf Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | 4.0.0 – < 4.7.9 | Undetermined |
| GHSA-xw65-4hp5-5hc7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | 4.0.0 – < 4.7.10 | Undetermined |
Withdrawn advisories (2)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-6r5x-hmgg-7h53 Remote code execution in Handlebars.js · withdrawn
- GHSA-fmr4-7g9q-7hc7 Moderate severity vulnerability that affects handlebars · withdrawn
Sources
| Source | Licence |
|---|