IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

handlebarsjs vulnerabilities (CVE)

CVE records published for handlebarsjs, newest first. Follow to get an email when a new one appears.

handlebars 6
6 results
8.3High
CVE-2026-33941

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

handlebars-lang handlebars.js; Red Hat Cluster Observability Operator 1.5.0; Red Hat Red Hat OpenShift Dev Spaces 3.27; Red Hat Cryostat 4

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI…

8.1High
CVE-2026-33940

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

handlebars-lang handlebars.js; Red Hat Cluster Observability Operator 1.5.0; Red Hat Red Hat OpenShift Dev Spaces 3.27; Red Hat Cryostat 4

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `unde…

7.5High
CVE-2026-33939

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

handlebars-lang handlebars.js; Red Hat Cluster Observability Operator 1.5.0; Red Hat Red Hat OpenShift Dev Spaces 3.27; Red Hat Cryostat 4

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProp…

8.1High
CVE-2026-33938

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

handlebars-lang handlebars.js; Red Hat Cluster Observability Operator 1.5.0; Red Hat Red Hat OpenShift Dev Spaces 3.27; Red Hat Cryostat 4

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that a…

9.8Critical
CVE-2026-33937

Handlebars.js has JavaScript Injection via AST Type Confusion

handlebars-lang handlebars.js; Red Hat Cluster Observability Operator 1.5.0; Red Hat Red Hat OpenShift Dev Spaces 3.27; Red Hat Cryostat 4

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…

1.9%EPSS