What’s Vulnerable › Products

handlebars-lang handlebars.js vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your handlebars-lang handlebars.js version is affected

Latest handlebars-lang handlebars.js vulnerabilities

• CVE-2026-106446 — Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) (CVSS 9.8)
• CVE-2026-106445 — Handlebars: JavaScript Injection via Own Property Check Bypass (CVSS 9.2)
• CVE-2026-106444 — Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates (CVSS 4.7)
• CVE-2026-33941 — Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options (CVSS 8.2)
• CVE-2026-33940 — Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial (CVSS 8.1)
• CVE-2026-33939 — Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation (CVSS 7.5)
• CVE-2026-33938 — Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block (CVSS 8.1)
• CVE-2026-33937 — Handlebars.js has JavaScript Injection via AST Type Confusion (CVSS 9.8)
• CVE-2026-33916 — Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection (CVSS 4.7)
• CVE-2021-23383 — Prototype Pollution (CVSS 9.8)
• CVE-2021-23369 — Remote Code Execution (RCE) (CVSS 9.8)
• CVE-2019-20922 — (CVSS 7.5)
• CVE-2019-20920 — (CVSS 8.1)