Skip to content
OpenAdvisories

Vendor

handlebars-lang

9 known vulnerabilities.

Products

handlebars.js 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-106445 Public exploit

    Handlebars: JavaScript Injection via Own Property Check Bypass

    Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of F…

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm
  • Critical 9.8
    CVE-2026-33937 Public exploit

    Handlebars.js has JavaScript Injection via AST Type Confusion

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm