Skip to content
OpenAdvisories

Vendor

handlebars-lang

9 known vulnerabilities.

Products

handlebars.js 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-106444

    Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

    Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping …

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm
  • Medium 4.7
    CVE-2026-33916

    Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prot…

    handlebars-lang handlebars.js handlebars node-handlebars Debian Ubuntu npm