handlebars-lang handlebars.js
9 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106446 | >= 4.0.0, < 4.7.10 | Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-106445 | >= 3.0.0, < 4.7.10 | Handlebars: JavaScript Injection via Own Property Check Bypass | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-106444 | >= 4.0.0, < 4.7.10 | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | MEDIUM 4.7 | 0.3 % | ||
| CVE-2026-33941 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | HIGH 8.3 | 0.3 % | ||
| CVE-2026-33940 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | HIGH 8.1 | 0.7 % | ||
| CVE-2026-33939 | >= 4.0.0, < 4.7.9 | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | HIGH 7.5 | 0.6 % | ||
| CVE-2026-33938 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | HIGH 8.1 | 0.7 % | ||
| CVE-2026-33937 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion | CRITICAL 9.8 | 1.9 % | ||
| CVE-2026-33916 | >= 4.0.0, < 4.7.9 | Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection | MEDIUM 4.7 | 0.3 % |