GHSA-P8WG-VRV2-V86F Handlebars: JavaScript Injection via Own Property Check Bypass

Summary Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: tr...

NPM: Handlebars: JavaScript Injection via Own Property Check Bypass

NPM: Handlebars: JavaScript Injection via Own Property Check Bypass vulnerability discovered by ? in WordPress Npm handlebars versions = 3.0.0, = 4.7.9...

Handlebars: JavaScript Injection via Own Property Check Bypass

Summary Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: tr...

cve-2026-33937

CVE-2026-33937 - Exploit PoC per RCE in Handlebars Descrizione CVE-2026-33937 è una vulnerabilità critica di Remote Code Execution RCE in Handlebars causata dalla gestione non sicura dell'input dell'Abstract Syntax Tree AST. La vulnerabilità consente agli attaccanti di iniettare codice JavaScript...

EUVD-2026-94986

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin, versions prior to 3.6.14 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization of gallery configuration values that can be overridden via the plugin's gallery shortcode . These values...

CVE-2026-104646: Improper Neutralization of Input During Web Page Generation

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

EUVD-2025-211052

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...

CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-106446

Handlebars versions 4.0.0 through 4.7.10 are vulnerable to JavaScript Injection due to AST Type Confusion in the compile() and precompile() functions. The root cause is that the compiler validates only a subset of AST values (PathExpression, NumberLiteral, and BooleanLiteral), allowing an attacke...

CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106445

The Handlebars template engine is vulnerable to JavaScript Injection in versions 4.0.0 through 4.7.10 . The root cause is an own property check bypass in the lookupProperty function, which returns Function.prototype.constructor before applying the prototype-access deny list. If an attacker can re...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

CVE-2026-106444

The Handlebars templating engine (versions 4.0.0 through 4.7.10 ) is vulnerable to JavaScript Injection due to improper escaping in the Handlebars.precompile() function. Specifically, lib/handlebars/compiler/code-gen.js uses quotedString() to emit static template text without escaping sequences t...

CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...