PT-2026-28569

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars allows Remote Code Execution RCE through a crafted Abstract Syntax Tree AST object. The Handlebars.compile function accepts either a template string or a pre-parsed AST. When an AS...

PT-2026-28571

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars templates containing decorator syntax referencing an unregistered decorator e.g., n can cause a Denial of Service. The compiled template calls lookupPropertydecorators, "n", which...

PT-2026-28573

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description The Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings – template file names and several CLI options – directly into the JavaScript it emits...

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

Summary resolvePartial in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted...

4coders-commons (>=0.0.1, <=0.0.2), @11ty/eleventy (0.3.3) +3662 more potentially affected by CVE-2026-33916 via handlebars (>=4.0.0, <=4.7.8)

handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-33916 Source advisory: OSV:GHSA-2QVQ-RJWJ-GVW9...

4coders-commons (>=0.0.1, <=0.0.2), @11ty/eleventy (0.3.3) +3662 more potentially affected by CVE-2026-33916 via handlebars (>=4.0.0, <=4.7.8)

handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-33916 Source advisory: SNYK:JS-HANDLEBARS-15789775...

GHSA-2QVQ-RJWJ-GVW9 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

Summary resolvePartial in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted...

Prototype Pollution

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution via the resolvePartial function. An attacker can inject malicious scripts into rendered output by polluting Object.prototype with a key...

Prototype Pollution

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution via the resolvePartial function. An attacker can inject malicious scripts into rendered output by polluting Object.prototype with a key matching a parti...

PT-2026-28566

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars is a templating engine that allows users to build semantic templates. Versions 4.0.0 through 4.7.8 contain a flaw in the resolvePartial function within the Handlebars runtime. This...

Dev jobs handlebars 安全漏洞

Dev jobs handlebars is a job search program by Felix Individual Developers. A security vulnerability exists in Dev jobs handlebars version 1.0 that stems from the use of an untrusted req.headers.host header to generate an absolute password reset link and force the use of an http scheme, which cou...

EUVD-2018-0564

Malware in sbrugna...

EUVD-2021-1052

Malware in sbrugna...

EUVD-2022-0849

Malicious code in bioql PyPI...

EUVD-2022-0882

Malicious code in bioql PyPI...

EUVD-2025-32226

Malicious code in bioql PyPI...

EUVD-2022-0789

Malicious code in bioql PyPI...

Malicious code in kss-node-handlebars-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cca63cd37e035f2a065952377f5c8b77ac950f443c2ac3233ead4b6203f62d9c The OpenSSF Package Analysis project identified 'kss-node-handlebars-builder' @ 9.0.1 npm as malicious. It is considered malicious because: - Th...

MAL-2025-47900 Malicious code in kss-node-handlebars-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cca63cd37e035f2a065952377f5c8b77ac950f443c2ac3233ead4b6203f62d9c The OpenSSF Package Analysis project identified 'kss-node-handlebars-builder' @ 9.0.1 npm as malicious. It is considered malicious because: - Th...

Linux Distros Unpatched Vulnerability : CVE-2015-8861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute...