ROOT-APP-NPM-CVE-2021-23369 CVE-2021-23369 in handlebars - Patched by Root

Root has patched CVE-2021-23369 in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-7RX3-28CR-V5WH GHSA-7rx3-28cr-v5wh in handlebars - Patched by Root

Root has patched GHSA-7rx3-28cr-v5wh in the handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33939 CVE-2026-33939 in handlebars - Patched by Root

Root has patched CVE-2026-33939 in the handlebars package for Root:npm. Multiple fixed versions available...

CLSA-2026-1791837378 TuxCare security update for handlebars (2 CVEs)

TuxCare rebuilt handlebars to address 2 CVEs. Fixed in 4.7.9-tuxcare.3...

CLSA-2026-1791836630 TuxCare security update for handlebars (3 CVEs)

TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 4.7.7-tuxcare.2...

CLSA-2026-1791827421 TuxCare security update for handlebars (1 CVE)

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 3.0.8-tuxcare.4...

CLSA-2026-1791821351 TuxCare security update for handlebars (1 CVE)

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 4.5.3-tuxcare.2...

CLSA-2026-1791814907 TuxCare security update for handlebars (1 CVE)

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 4.5.3-tuxcare.1...

CLSA-2026-1791806399 TuxCare security update for handlebars (1 CVE)

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 4.7.8-tuxcare.4...

CLSA-2026-1791795528 TuxCare security update for handlebars (1 CVE)

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 4.7.8-tuxcare.3...

CLSA-2026-1791679650 TuxCare security update for handlebars (1 CVE)

TuxCare rebuilt handlebars to address 1 CVE. Fixed in 4.7.8-tuxcare.2...

CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551

The openapi-typescript-codegen library, in versions through 0.31.0 , is vulnerable to a code injection flaw (CWE-94) triggered by the use of Handlebars templates. Attackers who control an OpenAPI document can inject arbitrary JavaScript by providing unescaped single quotes in specific fields, suc...

CVE-2026-106446

A flaw was found in Handlebars. Incomplete validation of pre-parsed AST objects passed to compile or precompile allows unchecked AST fields to be emitted into generated JavaScript. An attacker who can supply an object instead of a template string can inject and execute arbitrary JavaScript in the...

CVE-2026-106445

A flaw was found in Handlebars. The lookupProperty own-property check returns Function.prototype.constructor before the prototype-method deny list is applied. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template...

Server-Side Template Injection

Handlebars is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper enforcement of prototype-access restrictions in lookupProperty, which allows an attacker to bypass the deny list, access the Function constructor through a controlled template, and execute...

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Summary Handlebars.precompile generates JavaScript source that is commonly embedded in browser elements. Before the fix, static template text containing was emitted unchanged. HTML parsers recognize even inside a JavaScript string literal, closing the surrounding script element and allowing...

NPM: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

NPM: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates vulnerability discovered by ? in WordPress Npm handlebars versions = 4.0.0, = 4.7.9...

4coders-commons (>=0.0.1, <=0.0.2), @11ty/eleventy (0.3.3) +4451 more potentially affected by CVE-2026-106444 via handlebars (>=4.0.0, <=4.7.9)

handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-106444 Source advisory: GHSA-XW65-4HP5-5HC7...