handlebars vulnerabilities (npm)
40 vulnerabilities.
-
handlebarsnpm Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) 9.8 Critical -
handlebarsnpm Handlebars: JavaScript Injection via Own Property Check Bypass 9.2 Critical -
handlebarsnpm Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates 4.7 Medium -
handlebarsnpm Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options 8.3 High -
handlebarsnpm Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial 8.1 High -
handlebarsnpm Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation 7.5 High -
handlebarsnpm Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block 8.1 High -
handlebarsnpm Handlebars.js has JavaScript Injection via AST Type Confusion 9.8 Critical -
handlebarsnpm Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection 4.7 Medium -
handlebarsnpm Regular Expression Denial of Service in Handlebars 7.5 High -
handlebarsnpm Denial of Service in handlebars No score -
handlebarsnpm DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING 5.1 Medium -
handlebarsnpm DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization 5.3 Medium -
handlebarsnpm DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES 5.1 Medium -
handlebarsnpm DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR 5.1 Medium -
handlebarsnpm DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS 5.1 Medium -
handlebarsnpm DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags 5.3 Medium -
handlebarsnpm DOMPurify before 3.4.9 Trusted Types Policy State Contamination 5.1 Medium -
handlebarsnpm DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig 5.1 Medium -
handlebarsnpm fast-uri vulnerable to host confusion via percent-encoded authority delimiters 7.5 High -
handlebarsnpm fast-uri vulnerable to path traversal via percent-encoded dot segments 7.5 High -
handlebarsnpm http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass 6.9 Medium -
handlebarsnpm DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content 6.3 Medium -
handlebarsnpm DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM 6.1 Medium -
handlebarsnpm DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks 6.1 Medium -
handlebarsnpm DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) 6.0 Medium -
handlebarsnpm DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode 6.8 Medium -
handlebarsnpm DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback 6.9 Medium -
handlebarsnpm Arbitrary Code Execution in handlebars 4.0 Medium -
handlebarsnpm Arbitrary Code Execution in handlebars 4.0 Medium -
handlebarsnpm Arbitrary Code Execution in handlebars 4.5 Medium -
handlebarsnpm DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML 5.1 Medium -
handlebarsnpm DOMPurify nesting-based mXSS 10.0 Critical -
handlebarsnpm Tampering by prototype polution in DOMPurify 7.3 High -
handlebarsnpm Incorrect Default Permissions in log4js-node 5.5 Medium -
handlebarsnpm Prototype Pollution 5.6 Medium -
handlebarsnpm Remote Code Execution (RCE) 5.6 Medium -
handlebarsnpm Arbitrary Code Execution in handlebars 8.1 High -
handlebarsnpm Arbitrary Code Execution in handlebars 9.8 Critical -
handlebarsnpm Arbitrary Code Execution in handlebars 6.1 Medium