Vendor

    Handlebars-lang

    9 known vulnerabilities in products by Handlebars-lang, 0 of them actively exploited (CISA KEV).

    Key figures

    9

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Handlebars-lang
    CriticalCVE-2026-33937

    Handlebars.js has JavaScript Injection via AST Type Confusion

    also in 4 other products

    		9.8
    CriticalCVE-2026-106446

    Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

    		9.8
    CriticalCVE-2026-106445

    Handlebars: JavaScript Injection via Own Property Check Bypass

    		—
    HighCVE-2026-33938

    Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

    also in 4 other products

    		8.1
    HighCVE-2026-33940

    Handlebars-lang Handlebars.js: Code Injection

    also in 4 other products

    		8.1
    HighCVE-2026-33939

    Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

    also in 4 other products

    		7.5
    HighCVE-2026-33941

    Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

    also in 5 other products

    		8.2
    MediumCVE-2026-106444

    Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

    		4.7
    MediumCVE-2026-33916

    Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

    also in 3 other products

    		4.7

    Products

    Products by Handlebars-lang
    Handlebars.js90