handlebars-lang vulnerabilities
9 published CVEs name handlebars-lang among the affected products.
- 9Published CVEs9 of them scored
- 9Last 12 monthspublished in the last year
- 3Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
handlebars-lang · handlebars.js
Critical9.8 - CVE-2026-106445
Handlebars: JavaScript Injection via Own Property Check Bypass
handlebars-lang · handlebars.js
Critical9.2 - CVE-2026-106444
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
handlebars-lang · handlebars.js
Medium4.7 - CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
handlebars-lang · handlebars.js
High8.3 - CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
handlebars-lang · handlebars.js
High8.1 - CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
handlebars-lang · handlebars.js
High7.5 - CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
handlebars-lang · handlebars.js
High8.1 - CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
handlebars-lang · handlebars.js
Critical9.8 - CVE-2026-33916
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
handlebars-lang · handlebars.js
Medium4.7