Handlebars
Handlebarsjs · 10 CVEs
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Mar 27, 2026
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Mar 27, 2026
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Mar 27, 2026
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Mar 27, 2026
Handlebars.js has JavaScript Injection via AST Type Confusion
Mar 27, 2026
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Mar 27, 2026
Prototype Pollution
May 4, 2021
Remote Code Execution (RCE)
Apr 12, 2021
nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution
Sep 30, 2020
nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS
Sep 30, 2020
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-33941 | Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | HIGH | 0.22% | Mar 27, 2026 |
| CVE-2026-33940 | Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | HIGH | 0.79% | Mar 27, 2026 |
| CVE-2026-33939 | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | HIGH | 0.76% | Mar 27, 2026 |
| CVE-2026-33938 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | HIGH | 0.84% | Mar 27, 2026 |
| CVE-2026-33937 | Handlebars.js has JavaScript Injection via AST Type Confusion | CRITICAL | 1.74% | Mar 27, 2026 |
| CVE-2026-33916 | Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection | MEDIUM | 0.38% | Mar 27, 2026 |
| CVE-2021-23383 | Prototype Pollution | CRITICAL | 4.51% | May 4, 2021 |
| CVE-2021-23369 | Remote Code Execution (RCE) | CRITICAL | 7.03% | Apr 12, 2021 |
| CVE-2019-20920 | nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution | HIGH | 3.19% | Sep 30, 2020 |
| CVE-2019-20922 | nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS | HIGH | 3.69% | Sep 30, 2020 |
Showing 1 to 10 of 10 CVEs