handlebars vulnerabilities
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
- Registry
- npm
- Latest
- 4.7.10
- License
- MIT
22 known advisories
The latest version, 4.7.10, is not affected by any of them. Projects on older versions may be.
npm install handlebars@4.7.10Security advisories for handlebars
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
- Affected
- >=4.0.0 <4.7.10
- Fixed in
- 4.7.10
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
- Affected
- >=4.0.0 <4.7.10
- Fixed in
- 4.7.10
Handlebars: JavaScript Injection via Own Property Check Bypass
- Affected
- >=3.0.0 <4.7.10
- Fixed in
- 4.7.10
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
- Affected
- >=4.6.0 <4.7.9
- Fixed in
- 4.7.9
Handlebars.js has a Property Access Validation Bypass in container.lookup
- Affected
- >=4.0.0 <4.7.9
- Fixed in
- 4.7.9
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- Affected
- >=4.0.0 <4.7.9
- Fixed in
- 4.7.9
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- Affected
- >=4.0.0 <4.7.9
- Fixed in
- 4.7.9
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
- Affected
- >=4.0.0 <4.7.9
- Fixed in
- 4.7.9
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- Affected
- >=4.0.0 <4.7.9
- Fixed in
- 4.7.9
Handlebars.js has JavaScript Injection via AST Type Confusion
- Affected
- >=4.0.0 <4.7.9
- Fixed in
- 4.7.9
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
- Affected
- >=4.0.0 <4.7.9
- Fixed in
- 4.7.9
Prototype Pollution in handlebars
- Affected
- <4.7.7
- Fixed in
- 4.7.7
Regular Expression Denial of Service in Handlebars
- Affected
- >=4.0.0 <4.4.5
- Fixed in
- 4.4.5
Arbitrary Code Execution in Handlebars
- Affected
- <3.0.8 · >=4.0.0 <4.5.3
- Fixed in
- 3.0.8, 4.5.3
Remote code execution in handlebars when compiling templates
- Affected
- <4.7.7
- Fixed in
- 4.7.7
Arbitrary Code Execution in handlebars
- Affected
- <3.0.8 · >=4.0.0 <4.5.3
- Fixed in
- 3.0.8, 4.5.3
Prototype Pollution in handlebars
- Affected
- <3.0.8 · >=4.0.0 <4.5.3
- Fixed in
- 3.0.8, 4.5.3
Arbitrary Code Execution in handlebars
- Affected
- <3.0.8 · >=4.0.0 <4.5.2
- Fixed in
- 3.0.8, 4.5.2
Denial of Service in handlebars
- Affected
- >=4.0.0 <4.4.5
- Fixed in
- 4.4.5
Prototype Pollution in handlebars
- Affected
- >=4.0.0 <4.3.0 · <3.0.8
- Fixed in
- 3.0.8, 4.3.0
Prototype Pollution in handlebars
- Affected
- >=4.1.0 <4.1.2 · >=4.0.0 <4.0.14 · <3.0.7
- Fixed in
- 3.0.7, 4.0.14, 4.1.2
Cross-Site Scripting in handlebars
- Affected
- <4.0.0
- Fixed in
- 4.0.0
Which of your client projects still run an old handlebars?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.