handlebars (npm)
Advisories
31
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.7.10 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install handlebars@4.7.10yarn
yarn add handlebars@4.7.10pnpm
pnpm add handlebars@4.7.10Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8r5x-fm3f-whwj Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
Critical EPSS 0.79% |
>= 4.0.0, < 4.7.10 | 4.7.10 |
| GHSA-p8wg-vrv2-v86f Handlebars: JavaScript Injection via Own Property Check Bypass |
Critical EPSS 0.59% |
>= 3.0.0, < 4.7.10 | 4.7.10 |
| GHSA-xw65-4hp5-5hc7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates |
Medium EPSS 0.29% |
>= 4.0.0, < 4.7.10 | 4.7.10 |
| GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry |
Medium | >= 4.6.0, < 4.7.9 | 4.7.9 |
| GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup |
Low | >= 4.0.0, < 4.7.9 | 4.7.9 |
| GHSA-xjpj-3mr7-gcpf Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options |
High EPSS 0.30% |
>= 4.0.0, < 4.7.9 | 4.7.9 |
| GHSA-xhpv-hc6g-r9c6 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial |
High EPSS 0.71% |
>= 4.0.0, < 4.7.9 | 4.7.9 |
| GHSA-9cx6-37pm-9jff Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation |
High EPSS 0.63% |
>= 4.0.0, < 4.7.9 | 4.7.9 |
| GHSA-3mfm-83xf-c92r Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block |
High EPSS 0.72% |
>= 4.0.0, < 4.7.9 | 4.7.9 |
| GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion |
Critical EPSS 1.91% |
>= 4.0.0, < 4.7.9 | 4.7.9 |
| GHSA-2qvq-rjwj-gvw9 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection |
Medium EPSS 0.28% |
>= 4.0.0, < 4.7.9 | 4.7.9 |
| GHSA-765h-qjxv-5f44 Prototype Pollution in handlebars |
Critical EPSS 4.51% |
< 4.7.7 | 4.7.7 |
| GHSA-62gr-4qp9-h98f Regular Expression Denial of Service in Handlebars |
High EPSS 3.69% |
>= 4.0.0, < 4.4.5 | 4.4.5 |
| GHSA-3cqr-58rm-57f8 Arbitrary Code Execution in Handlebars |
High EPSS 3.15% |
< 3.0.8 | 3.0.8 |
| GHSA-3cqr-58rm-57f8 Arbitrary Code Execution in Handlebars |
High EPSS 3.15% |
>= 4.0.0, < 4.5.3 | 4.5.3 |
| GHSA-f2jv-r9rf-7988 Remote code execution in handlebars when compiling templates |
Critical EPSS 7.03% |
< 4.7.7 | 4.7.7 |
| GHSA-q2c6-c6pm-g3gh Arbitrary Code Execution in handlebars |
High | >= 4.0.0, < 4.5.3 | 4.5.3 |
| GHSA-q2c6-c6pm-g3gh Arbitrary Code Execution in handlebars |
High | < 3.0.8 | 3.0.8 |
| GHSA-g9r4-xpmj-mj65 Prototype Pollution in handlebars |
High | < 3.0.8 | 3.0.8 |
| GHSA-g9r4-xpmj-mj65 Prototype Pollution in handlebars |
High | >= 4.0.0, < 4.5.3 | 4.5.3 |
| GHSA-2cf5-4w76-r9qv Arbitrary Code Execution in handlebars |
High | < 3.0.8 | 3.0.8 |
| GHSA-2cf5-4w76-r9qv Arbitrary Code Execution in handlebars |
High | >= 4.0.0, < 4.5.2 | 4.5.2 |
| GHSA-f52g-6jhx-586p Denial of Service in handlebars |
Medium | >= 4.0.0, < 4.4.5 | 4.4.5 |
| GHSA-w457-6q6x-cgp9 Prototype Pollution in handlebars |
Critical EPSS 7.07% |
>= 4.0.0, < 4.3.0 | 4.3.0 |
| GHSA-w457-6q6x-cgp9 Prototype Pollution in handlebars |
Critical EPSS 7.07% |
< 3.0.8 | 3.0.8 |
| GHSA-6r5x-hmgg-7h53 Remote code execution in Handlebars.js Withdrawn |
Medium | < 4.1.0 | 4.1.0 |
| GHSA-q42p-pg8m-cqh6 Prototype Pollution in handlebars |
High | >= 4.1.0, < 4.1.2 | 4.1.2 |
| GHSA-q42p-pg8m-cqh6 Prototype Pollution in handlebars |
High | >= 4.0.0, < 4.0.14 | 4.0.14 |
| GHSA-q42p-pg8m-cqh6 Prototype Pollution in handlebars |
High | < 3.0.7 | 3.0.7 |
| GHSA-9prh-257w-9277 Cross-Site Scripting in handlebars |
Medium EPSS 2.61% |
< 4.0.0 | 4.0.0 |
| GHSA-fmr4-7g9q-7hc7 Moderate severity vulnerability that affects handlebars Withdrawn |
Medium | < 4.0.0 | 4.0.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor