Product by Handlebars-lang
Handlebars.js
9 known vulnerabilities in Handlebars.js (Handlebars-lang), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-33937 | Handlebars.js has JavaScript Injection via AST Type Confusion | 9.8 | |
| Critical | CVE-2026-106446 | Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) | 9.8 | |
| Critical | CVE-2026-106445 | Handlebars: JavaScript Injection via Own Property Check Bypass | — | |
| High | CVE-2026-33938 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | 8.1 | |
| High | CVE-2026-33940 | Handlebars-lang Handlebars.js: Code Injection | 8.1 | |
| High | CVE-2026-33939 | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | 7.5 | |
| High | CVE-2026-33941 | Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | 8.2 | |
| Medium | CVE-2026-106444 | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | 4.7 | |
| Medium | CVE-2026-33916 | Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection | 4.7 |