Skip to main content
cve.nowby Sazabi
← npm
npmPackage

handlebars

15 known vulnerabilities (3 critical, 4 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
4.7.10 (Oct 5, 2026): no advisory affects it
Newest unaffected release
4.7.10 (Oct 5, 2026), the latest release
Advisories
15 · 3 critical, 4 high, 4 medium
Weekly downloads
57.9M
Dependents
57.1K
Releases
82 since 1.0.6 (Jul 23, 2012)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 15 advisoriesShow fewer advisories
  • CVE-2019-20922
    Affects 4.0.0 to 4.4.4 (4.4.5 is outside it)
  • CVE-2019-19919
    Affects 1.0.2-beta to 3.0.7 (3.0.8 is outside it); 4.0.0 to 4.2.2 (4.3.0 is outside it)
  • CVE-2015-8861
    Affects 1.0.2-beta to 3.0.8 (4.0.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

  • CVE-2026-106446Critical 9.8

    Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

    Affected: from 4.0.0, fixed in 4.7.10.

    Fixed in 4.7.10 (released Oct 5, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    61% of handlebars downloads last week were affected versions (39M).

  • CVE-2026-106445Critical 9.2

    Handlebars: JavaScript Injection via Own Property Check Bypass

    Affected: from 3.0.0, fixed in 4.7.10.

    Fixed in 4.7.10 (released Oct 5, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    61% of handlebars downloads last week were affected versions (39.1M).

  • CVE-2026-106444Medium 4.7

    Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

    Affected: from 4.0.0, fixed in 4.7.10.

    Fixed in 4.7.10 (released Oct 5, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    61% of handlebars downloads last week were affected versions (39M).

  • Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

    Affected: from 4.0.0, fixed in 4.7.9.

    Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    34% of handlebars downloads last week were affected versions (21.7M).

  • Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

    Affected: from 4.0.0, fixed in 4.7.9.

    Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    34% of handlebars downloads last week were affected versions (21.7M).

  • Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

    Affected: from 4.0.0, fixed in 4.7.9.

    Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    34% of handlebars downloads last week were affected versions (21.7M).

  • Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

    Affected: from 4.0.0, fixed in 4.7.9.

    Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    34% of handlebars downloads last week were affected versions (21.7M).

  • CVE-2026-33937Critical 9.8

    Handlebars.js has JavaScript Injection via AST Type Confusion

    Affected: from 4.0.0, fixed in 4.7.9.

    Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    34% of handlebars downloads last week were affected versions (21.7M).

  • CVE-2026-33916Medium 4.7

    Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

    Affected: from 4.0.0, fixed in 4.7.9.

    Fixed in 4.7.9 (released Mar 26, 2026, 1 day before disclosure).

    The latest release, 4.7.10, is not affected.

    34% of handlebars downloads last week were affected versions (21.7M).

  • CVE-2021-23383Medium 5.6

    Prototype Pollution

    Affected: fixed in 4.7.7.

    Fixed in 4.7.7 (released Feb 15, 2021, 78 days before disclosure).

    The latest release, 4.7.10, is not affected.

    3% of handlebars downloads last week were affected versions (1.9M).

  • CVE-2021-23369Medium 5.6

    Remote Code Execution (RCE)

    Affected: fixed in 4.7.7.

    Fixed in 4.7.7 (released Feb 15, 2021, 56 days before disclosure).

    The latest release, 4.7.10, is not affected.

    3% of handlebars downloads last week were affected versions (1.9M).

  • Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.

    Affected: fixed in 3.0.8; from 4.0.0, fixed in 4.5.3.

    Fixed in 3.0.8 (released Feb 23, 2020, 220 days before disclosure) and 4.5.3 (released Nov 18, 2019, 317 days before disclosure).

    The latest release, 4.7.10, is not affected.

    1.9% of handlebars downloads last week were affected versions (1.2M).

  • Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching.

    Affected: from 4.0.0, fixed in 4.4.5.

    Fixed in 4.4.5 (released Oct 20, 2019, 346 days before disclosure).

    The latest release, 4.7.10, is not affected.

    1.4% of handlebars downloads last week were affected versions (924.5K).

  • Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.

    Affected: from 4.0.0, fixed in 4.3.0; fixed in 3.0.8.

    Fixed in 3.0.8 (released Feb 23, 2020, 65 days after disclosure) and 4.3.0 (released Sep 24, 2019, 87 days before disclosure).

    The latest release, 4.7.10, is not affected.

    1.8% of handlebars downloads last week were affected versions (1.1M).

  • The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a…

    Affected: fixed in 4.0.0.

    Fixed in 4.0.0 (released Sep 1, 2015, 510 days before disclosure).

    The latest release, 4.7.10, is not affected.

    0.5% of handlebars downloads last week were affected versions (313.3K).