395 matches found
Access of Resource Using Incompatible Type ('Type Confusion')
Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the compile function. An attacker can execute arbitrary code by supplying a crafted Abstract Syntax Tree AST...
handlebars 安全漏洞
Handlebars is a semantic web template system. Versions of Handlebars 4.7.8 and earlier contain security vulnerabilities. These vulnerabilities stem from the resolvePartial function, which does not prevent prototype chain traversal. This can lead to prototype pollution, thereby enabling...
PT-2026-28572
Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars allows users to build semantic templates. A crafted object placed in the template context can bypass conditional guards in the resolvePartial function, causing invokePartial to...
handlebars 安全漏洞
Handlebars is a semantic web template system. Versions of Handlebars 4.7.8 and earlier contain security vulnerabilities. These vulnerabilities stem from the ability for custom objects to bypass all conditional protections in resolvePartial, allowing attackers to execute arbitrary commands and...
handlebars 代码问题漏洞
Handlebars is a semantic web template system. Versions of Handlebars 4.7.8 and earlier have a code vulnerability that arises when templates contain unregistered decorator references, leading to an unhandled TypeError. This can cause Node.js processes to crash, resulting in a denial-of-service...
handlebars 安全漏洞
Handlebars is a semantic web template system. Versions of Handlebars 4.7.8 and earlier contain security vulnerabilities. These vulnerabilities stem from the improper handling of the value field in NumberLiteral AST nodes by the Handlebars.compile function. This could allow attackers to inject and...
PT-2026-28571
Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars templates containing decorator syntax referencing an unregistered decorator e.g., n can cause a Denial of Service. The compiled template calls lookupPropertydecorators, "n", which...
PT-2026-28570
Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars allows users to build semantic templates. A flaw exists where the @partial-block special variable is stored in the template data context and is mutable from within a template via...
PT-2026-28569
Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars allows Remote Code Execution RCE through a crafted Abstract Syntax Tree AST object. The Handlebars.compile function accepts either a template string or a pre-parsed AST. When an AS...
PT-2026-28573
Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description The Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings – template file names and several CLI options – directly into the JavaScript it emits...
4coders-commons (>=0.0.1 <=0.0.2), @11ty/eleventy (=0.3.3) +3644 more potentially affected by CVE-2021-23369 +2 more via handlebars (>=4.0.0 <=4.7.8)
handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1, =0.0.0-3b548b7bf6ff6554f724240da3a11be924237e6c, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2021-23369, CVE-2021-23383, CVE-2026-33916 Source advisory: OSV:GHSA-2QVQ-RJWJ-GVW...
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Summary resolvePartial in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted...
org.webjars.npm:directory-encoder (=0.9.2), org.webjars.npm:engine-handlebars (=0.8.2) +6 more potentially affected by CVE-2026-33916 via org.webjars.npm:handlebars (>=4.0.14 <=4.7.8)
org.webjars.npm:handlebars MAVEN version =4.0.14, =1.5.0, =2.0.0, =2.0.0, =2.1.0, =2.1.1 Source cves: CVE-2026-33916 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789776...
GHSA-2QVQ-RJWJ-GVW9 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Summary resolvePartial in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted...
4coders-commons (>=0.0.1 <=0.0.2), @11ty/eleventy (=0.3.3) +3644 more potentially affected by CVE-2026-33916 via handlebars (>=4.0.0 <=4.7.8)
handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1, =0.0.0-3b548b7bf6ff6554f724240da3a11be924237e6c, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-33916 Source advisory: SNYK:JS-HANDLEBARS-15789775...
Prototype Pollution
Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution via the resolvePartial function. An attacker can inject malicious scripts into rendered output by polluting Object.prototype with a key...
Prototype Pollution
Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution via the resolvePartial function. An attacker can inject malicious scripts into rendered output by polluting Object.prototype with a key matching a parti...
PT-2026-28566
Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars is a templating engine that allows users to build semantic templates. Versions 4.0.0 through 4.7.8 contain a flaw in the resolvePartial function within the Handlebars runtime. This...
Dev jobs handlebars 安全漏洞
Dev jobs handlebars is a job search program by Felix Individual Developers. A security vulnerability exists in Dev jobs handlebars version 1.0 that stems from the use of an untrusted req.headers.host header to generate an absolute password reset link and force the use of an http scheme, which cou...
