CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 06/10/2026 |
| GHSA-7rx3-28cr-v5wh | 보통4.8 | Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry | 29/03/2026 |
| GHSA-442j-39wm-28r2 | 낮음3.7 | Handlebars.js has a Property Access Validation Bypass in container.lookup | 29/03/2026 |
| CVE-2026-33941 | 높음8.2 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any | 27/03/2026 |
| CVE-2026-33940 | 높음8.1 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved par | 27/03/2026 |
| CVE-2026-33939 | 높음7.5 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `undefined`. The runtim | 27/03/2026 |
| CVE-2026-33938 | 높음8.1 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-b | 27/03/2026 |
| CVE-2026-33937 | 심각9.8 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sa | 27/03/2026 |
| CVE-2026-33916 | 보통4.7 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been pollu | 27/03/2026 |
| CVE-2021-23383 | 심각9.8 | The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. | 04/05/2021 |
| CVE-2021-23369 | 심각9.8 | The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source. | 12/04/2021 |
| CVE-2019-20922 | 높음7.5 | Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources. | 30/09/2020 |
| CVE-2019-20920 | 높음8.1 | Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's br | 30/09/2020 |
| GHSA-q2c6-c6pm-g3gh | 높음 | Arbitrary Code Execution in handlebars | 04/09/2020 |
| GHSA-g9r4-xpmj-mj65 | 높음 | Prototype Pollution in handlebars | 04/09/2020 |
| GHSA-2cf5-4w76-r9qv | 높음7.3 | Arbitrary Code Execution in handlebars | 04/09/2020 |
| GHSA-f52g-6jhx-586p | 보통 | Denial of Service in handlebars | 03/09/2020 |
| CVE-2019-19919 | 심각9.8 | Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads. | 20/12/2019 |