HIGH7.3npm
GHSA-2cf5-4w76-r9qvArbitrary Code Execution in handlebars
Modified: 9/10/2026
package
npm/handlebars
pkg:npm/handlebars
MEDIUM4.7npm
GHSA-2qvq-rjwj-gvw9· CVE-2026-33916Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Modified: 9/10/2026
CRITICAL9.8npm
GHSA-2w6w-674q-4c4q· CVE-2026-33937Handlebars.js has JavaScript Injection via AST Type Confusion
Modified: 9/10/2026
HIGH8.1npm
GHSA-3cqr-58rm-57f8· CVE-2019-20920, SNYK-JS-HANDLEBARS-534478Arbitrary Code Execution in Handlebars
Modified: 9/10/2026
HIGH8.1npm
GHSA-3mfm-83xf-c92r· CVE-2026-33938Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Modified: 9/10/2026
LOW3.7npm
GHSA-442j-39wm-28r2Handlebars.js has a Property Access Validation Bypass in container.lookup
Modified: 9/10/2026
HIGH7.5npm
GHSA-62gr-4qp9-h98f· CVE-2019-20922, SNYK-JS-HANDLEBARS-480388Regular Expression Denial of Service in Handlebars
Modified: 7/8/2026
CRITICAL9.8npm
GHSA-765h-qjxv-5f44· CVE-2021-23383Prototype Pollution in handlebars
Modified: 9/10/2026
MEDIUM4.8npm
GHSA-7rx3-28cr-v5whHandlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
Modified: 9/10/2026
HIGH7.5npm
GHSA-9cx6-37pm-9jff· CVE-2026-33939Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Modified: 9/10/2026
MEDIUM6.1npm
GHSA-9prh-257w-9277· CVE-2015-8861Cross-Site Scripting in handlebars
Modified: 9/10/2026
CRITICAL9.8npmMaven
GHSA-f2jv-r9rf-7988· CVE-2021-23369Remote code execution in handlebars when compiling templates
Modified: 9/10/2026
MEDIUMnpm
GHSA-f52g-6jhx-586pDenial of Service in handlebars
Modified: 8/31/2020
HIGHnpm
GHSA-g9r4-xpmj-mj65Prototype Pollution in handlebars
Modified: 9/10/2026
HIGHnpm
GHSA-q2c6-c6pm-g3ghArbitrary Code Execution in handlebars
Modified: 9/10/2026
HIGH7.3npm
GHSA-q42p-pg8m-cqh6Prototype Pollution in handlebars
Modified: 9/10/2026
CRITICAL9.8npmRubyGems
GHSA-w457-6q6x-cgp9· CVE-2019-19919Prototype Pollution in handlebars
Modified: 9/10/2026
HIGH8.1npm
GHSA-xhpv-hc6g-r9c6· CVE-2026-33940Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Modified: 9/10/2026
HIGH8.2npm
GHSA-xjpj-3mr7-gcpf· CVE-2026-33941Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Modified: 9/10/2026