6 results · Clear filters · Feed
-
Critical 9.2CVE-2026-106445 Public exploit
Handlebars: JavaScript Injection via Own Property Check Bypass
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of F…
-
High 7.5CVE-2026-93687 Public exploit
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an u…
-
High 8.1CVE-2026-4800 Public exploit
lodash vulnerable to Code Injection via `_.template` imports key names
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …
-
Critical 9.8CVE-2026-33937 Public exploit
Handlebars.js has JavaScript Injection via AST Type Confusion
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…
-
High 7.5CVE-2026-33671 Public exploit
Picomatch has a ReDoS vulnerability via extglob quantifiers
Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…
-
Medium 6.9CVE-2025-13465 Public exploit
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…