Skip to content
OpenAdvisories

Package · npm

handlebars

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-106444

    Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

    Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping …

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm
  • Medium 4.8
    GHSA-7rx3-28cr-v5wh

    Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry

    ## Summary The prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric `__lookupSetter__`. This omission is only exploitable when the…

    handlebars npm
  • Medium 4.7
    CVE-2026-33916

    Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prot…

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm
  • Medium 5.6
    CVE-2021-23383 Public exploit

    Prototype Pollution

    The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

    handlebars node-handlebars node-handlebars Debian Ubuntu npm
  • Medium 5.6
    CVE-2021-23369 Public exploit

    Remote Code Execution (RCE)

    The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

    handlebars node-handlebars node-handlebars org.webjars.npm:handlebars Debian Ubuntu npm Maven
  • Medium —
    GHSA-f52g-6jhx-586p

    Denial of Service in handlebars

    Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. ## …

    handlebars npm
  • Medium 6.1
    CVE-2015-8861

    Cross-Site Scripting in handlebars

    The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

    handlebars mustache.js Debian npm