Skip to content
Handlebars-lang Handlebars.js vulnerabilities
-
handlebars-lang handlebars.js
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
CVE-2026-106446
Fix available
9.8 Critical
-
handlebars-lang handlebars.js
Handlebars: JavaScript Injection via Own Property Check Bypass
CVE-2026-106445
Public exploitFix available
9.2 Critical
-
handlebars-lang handlebars.js
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
CVE-2026-106444
Fix available
4.7 Medium
-
handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 more
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
CVE-2026-33941
Fix available
8.3 High
-
handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 more
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
CVE-2026-33940
Fix available
8.1 High
-
handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 more
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
CVE-2026-33939
Fix available
7.5 High
-
handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 more
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
CVE-2026-33938
Fix available
8.1 High
-
handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 more
Handlebars.js has JavaScript Injection via AST Type Confusion
CVE-2026-33937
Public exploitFix available
9.8 Critical
-
handlebars-lang handlebars.js, handlebarsjs handlebars +1 more
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
CVE-2026-33916
Fix available
4.7 Medium