handlebarsjs has 8 CVEs on record between 2020 and 2026. The busiest recent month was March 2026 with 5. The median CVSS is 8.1 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-94 (6) and CWE-843 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Weakness classes
Products
- handlebars 8
Worst active — by depth score
CVE-2026-33937Critical· 9.8Handlebars provides the power necessary to let users build semantic templates66CVE-2026-33941High· 8.2Handlebars provides the power necessary to let users build semantic templates57CVE-2026-33940High· 8.1Handlebars provides the power necessary to let users build semantic templates45CVE-2026-33938High· 8.1Handlebars provides the power necessary to let users build semantic templates45CVE-2019-20920High· 8.1Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution45
handlebarsjs vulnerabilities
CVEs affecting handlebarsjs, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-33941High· 8.2PoCHandlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file…
CVE-2026-33940High· 8.1Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePart…
CVE-2026-33939High· 7.5Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled temp…
CVE-2026-33938High· 8.1Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a templ…
CVE-2026-33937Critical· 9.8PoCHandlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLitera…
CVE-2021-23383Medium· 5.6PoC⚖ disputedThe package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
CVE-2021-23369Medium· 5.6PoCThe package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
CVE-2019-20920High· 8.1Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to…