de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0), events.boudicca:eventcollector-client (>=0.6.0, <=0.7.0) +4 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=4.0.0, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =4.0.0, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.8, =0.5.0 Source cves: CVE-2026-63490 Source advisory: GHSA-G29J-RWFV-H99W...

de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0), events.boudicca:eventcollector-client (>=0.6.0, <=0.7.0) +4 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=4.0.0, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =4.0.0, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.8, =0.5.0 Source cves: CVE-2026-63490 Source advisory: OSV:GHSA-G29J-RWFV-H99W...

com.github.jknack:todomvc-jpa (>=0.3.4, <=0.3.6) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (0.6.1)

com.github.jknack:handlebars-springmvc MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - com.github.jknack:todomvc-jpa =0.3.4, =0.3.6 Source cves: CVE-2026-63490 Source...

pl.allegro.tech.boot:handlebars-spring-boot-starter (>=0.2.0, <=0.2.1), pl.allegro.tech.boot:spring-boot-starter-handlebars (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.0.0)

com.github.jknack:handlebars-springmvc MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter =0.2.0, =0.1.0, =0.1.1 Source...

pl.allegro.tech.boot:handlebars-spring-boot-starter (>=0.2.3, <=0.2.4) potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (2.2.3)

com.github.jknack:handlebars-springmvc MAVEN version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars-springmvc and may be impacted: - pl.allegro.tech.boot:handlebars-spring-boot-starter =0.2.3, =0.2.4 Source cves:...

CVE-2026-63490

creationtimestamp| type| source ---|---|--- 2026-08-20 17:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtjpvjbeij2o 2026-09-03 11:31:46+00:00| seen| https://gist.github.com/alon710/ac9a336078ecd53e84e4088322a7f9af 2026-09-30 02:00:10+00:00| seen|...

com.github.jknack:todomvc-jpa (>=0.3.4, <=0.3.6), de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0) +6 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=0.6.1, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =0.6.1, =0.3.4, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2026-63490 Source advisory: MEND:CVE-2026-63490...

CVE-2026-63490

CVE-2026-63490 is an arbitrary file read vulnerability in the handlebars-springmvc module of Handlebars.java (prior to 4.5.3). The SpringTemplateLoader resolves Spring MVC view names via Spring's ResourceLoader without path-containment validation. An attacker can craft a view name using a file: o...