Skip to content
OpenAdvisories

Package · Ubuntu

ruby-handlebars-assets

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2026-106446

    Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

    Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLit…

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm
  • Medium 4.7
    CVE-2026-106444

    Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

    Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping …

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm