Handlebars

This hub aggregates every CVE we track for Handlebars, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Handlebars.

• GHSA-7rx3-28cr-v5whHandlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist EntryMar 29, 2026
• GHSA-442j-39wm-28r2Handlebars.js has a Property Access Validation Bypass in container.lookupMar 29, 2026
• CVE-2026-33941Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options8.2Mar 27, 2026
• CVE-2026-33940Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial8.1Mar 27, 2026
• CVE-2026-33939Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation7.5Mar 27, 2026
• CVE-2026-33938Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block8.1Mar 27, 2026
• CVE-2026-33937Handlebars.js has JavaScript Injection via AST Type Confusion9.8Mar 27, 2026
• CVE-2026-33916Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection4.7Mar 27, 2026
• CVE-2021-23383Prototype Pollution5.6May 4, 2021
• CVE-2021-23369Remote Code Execution (RCE)5.6Apr 12, 2021
• CVE-2019-20920Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute a...8.1Sep 30, 2020
• CVE-2019-20922Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may all...7.5Sep 30, 2020
• GHSA-q2c6-c6pm-g3ghArbitrary Code Execution in handlebarsSep 4, 2020
• GHSA-g9r4-xpmj-mj65Prototype Pollution in handlebarsSep 4, 2020
• GHSA-2cf5-4w76-r9qvArbitrary Code Execution in handlebarsSep 4, 2020