Skip to content
OpenAdvisories

Package · Wolfi

ts-patch

43 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-106446

    Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

    Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLit…

    handlebars-lang handlebars.js renovate prism Debian Ubuntu Wolfi npm
  • Critical 9.2
    CVE-2026-106445 Public exploit

    Handlebars: JavaScript Injection via Own Property Check Bypass

    Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of F…

    handlebars-lang handlebars.js renovate prism Debian Ubuntu Wolfi npm
  • Critical 9.8
    CVE-2026-33937 Public exploit

    Handlebars.js has JavaScript Injection via AST Type Confusion

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm