EUVD-2026-93974

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates...

NPM: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

NPM: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates vulnerability discovered by ? in WordPress Npm handlebars versions = 4.0.0, = 4.7.9...

4coders-commons (>=0.0.1, <=0.0.2), @11ty/eleventy (0.3.3) +4451 more potentially affected by CVE-2026-106444 via handlebars (>=4.0.0, <=4.7.9)

handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-106444 Source advisory: GHSA-XW65-4HP5-5HC7...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the compiler's handling of pre-parsed AST objects passed to compile or precompile. When a caller supplies a...

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Summary Handlebars.compile and Handlebars.precompile accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into...

EUVD-2026-93969

Handlebars: JavaScript Injection via AST Type Confusion in compile bypass of CVE-2026-33937...

NPM: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

NPM: Handlebars: JavaScript Injection via AST Type Confusion in compile bypass of CVE-2026-33937 vulnerability discovered by ? in WordPress Npm handlebars versions = 4.0.0, = 4.7.9...

4coders-commons (>=0.0.1, <=0.0.2), @11ty/eleventy (0.3.3) +4451 more potentially affected by CVE-2026-106446 via handlebars (>=4.0.0, <=4.7.9)

handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-106446 Source advisory: SNYK:JS-HANDLEBARS-20574183...

4coders-commons (>=0.0.1, <=0.0.2), @11ty/eleventy (0.3.3) +4451 more potentially affected by CVE-2026-106446 via handlebars (>=4.0.0, <=4.7.9)

handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-106446 Source advisory: OSV:GHSA-8R5X-FM3F-WHWJ...

GHSA-8R5X-FM3F-WHWJ Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Summary Handlebars.compile and Handlebars.precompile accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into...

4coders-commons (>=0.0.1, <=0.0.2), @11ty/eleventy (0.3.3) +4451 more potentially affected by CVE-2026-106446 via handlebars (>=4.0.0, <=4.7.9)

handlebars NPM version =4.0.0, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.16.0, =1.16.0, =1.16.0, =2.4.4 and more Source cves: CVE-2026-106446 Source advisory: GHSA-8R5X-FM3F-WHWJ...

Handlebars: JavaScript Injection via Own Property Check Bypass

Summary Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: tr...

NPM: Handlebars: JavaScript Injection via Own Property Check Bypass

NPM: Handlebars: JavaScript Injection via Own Property Check Bypass vulnerability discovered by ? in WordPress Npm handlebars versions = 3.0.0, = 4.7.9...

GHSA-P8WG-VRV2-V86F Handlebars: JavaScript Injection via Own Property Check Bypass

Summary Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: tr...

EUVD-2026-93952

Handlebars: JavaScript Injection via Own Property Check Bypass...

08cms (1.0.0), 3m5-coco (>=0.0.2, <=0.1.65) +5540 more potentially affected by CVE-2026-106445 via handlebars (>=3.0.0, <=4.7.9)

handlebars NPM version =3.0.0, =0.0.2, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.16, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =2.0.0 and more Source cves: CVE-2026-106445 Source advisory: OSV:GHSA-P8WG-VRV2-V86F...

08cms (1.0.0), 3m5-coco (>=0.0.2, <=0.1.65) +5540 more potentially affected by CVE-2026-106445 via handlebars (>=3.0.0, <=4.7.9)

handlebars NPM version =3.0.0, =0.0.2, =0.0.1, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.1.1-pr-7-1d68cf28da, =0.0.16, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =2.0.0 and more Source cves: CVE-2026-106445 Source advisory: GHSA-P8WG-VRV2-V86F...

cve-2026-33937

CVE-2026-33937 - Exploit PoC per RCE in Handlebars Descrizione CVE-2026-33937 è una vulnerabilità critica di Remote Code Execution RCE in Handlebars causata dalla gestione non sicura dell'input dell'Abstract Syntax Tree AST. La vulnerabilità consente agli attaccanti di iniettare codice JavaScript...

ROOT-APP-NPM-GHSA-G9R4-XPMJ-MJ65 GHSA-g9r4-xpmj-mj65 in handlebars - Patched by Root

Root has patched GHSA-g9r4-xpmj-mj65 in the handlebars package for Root:npm. Multiple fixed versions available...

SUSE CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...