handlebars-lang handlebars.js
9 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106446 | >= 4.0.0, < 4.7.10 | Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-106445 | >= 3.0.0, < 4.7.10 | Handlebars: JavaScript Injection via Own Property Check Bypass | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-106444 | >= 4.0.0, < 4.7.10 | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | MEDIUM 4.7 | 0.3 % | ||
| CVE-2026-33941 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | HIGH 8.3 | 0.3 % | ||
| CVE-2026-33940 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | HIGH 8.1 | 0.7 % | ||
| CVE-2026-33939 | >= 4.0.0, < 4.7.9 | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | HIGH 7.5 | 0.6 % | ||
| CVE-2026-33938 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | HIGH 8.1 | 0.7 % | ||
| CVE-2026-33937 | >= 4.0.0, < 4.7.9 | Handlebars.js has JavaScript Injection via AST Type Confusion | CRITICAL 9.8 | 1.9 % | ||
| CVE-2026-33916 | >= 4.0.0, < 4.7.9 | Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection | MEDIUM 4.7 | 0.3 % |