CVE-2026-47218

The runwasi project contains a vulnerability in containerd-shim-wasmtime-v1 prior to version 0.6.1 . The flaw allows an attacker to provide Wasmtime precompiled bytes directly within an OCI image layer, which the shim incorrectly treats as a trusted artifact from the precompile-cache path. By des...

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Summary Handlebars.precompile generates JavaScript source that is commonly embedded in browser elements. Before the fix, static template text containing was emitted unchanged. HTML parsers recognize even inside a JavaScript string literal, closing the surrounding script element and allowing...

EUVD-2026-93969

Handlebars: JavaScript Injection via AST Type Confusion in compile bypass of CVE-2026-33937...

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Summary Handlebars.compile and Handlebars.precompile accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into...

GHSA-8R5X-FM3F-WHWJ Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Summary Handlebars.compile and Handlebars.precompile accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the compiler's handling of pre-parsed AST objects passed to compile or precompile. When a...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the compiler's handling of pre-parsed AST objects passed to compile or precompile. When a caller supplies a...

CVE-2026-106446

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

DEBIAN-CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

Cross-site Scripting (XSS)

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the quotedString function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that Handlebars.precompi...

PT-2026-107182

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.9 Description Handlebars.compile and Handlebars.precompile functions accept pre-parsed AST Abstract Syntax Tree objects but only validate specific PathExpression, NumberLiteral, and BooleanLiteral values...

Improper Synchronization

Overview Affected versions of this package are vulnerable to Improper Synchronization through the bridgeOut precompile. An attacker can restore their ERC-20 token balance and allowance after a burn operation by exploiting stale state overwrites in the dual-context state management, enabling...

Improper Synchronization

Overview Affected versions of this package are vulnerable to Improper Synchronization through the bridgeOut precompile. An attacker can restore their ERC-20 token balance and allowance after a burn operation by exploiting stale state overwrites in the dual-context state management, enabling...

Improper Synchronization

Overview Affected versions of this package are vulnerable to Improper Synchronization through the bridgeOut precompile. An attacker can restore their ERC-20 token balance and allowance after a burn operation by exploiting stale state overwrites in the dual-context state management, enabling...

Improper Synchronization

Overview Affected versions of this package are vulnerable to Improper Synchronization through the bridgeOut precompile. An attacker can restore their ERC-20 token balance and allowance after a burn operation by exploiting stale state overwrites in the dual-context state management, enabling...

Improper Synchronization

Overview Affected versions of this package are vulnerable to Improper Synchronization through the bridgeOut precompile. An attacker can restore their ERC-20 token balance and allowance after a burn operation by exploiting stale state overwrites in the dual-context state management, enabling...

NPM: next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

NPM: next-intl has prototype pollution with experimental.messages.precompile via attacker-controlled translation catalog keys vulnerability discovered by ? in WordPress Npm next-intl versions = 4.9.1...

Prototype Pollution

Overview icu-minify is an ICU message format compiler with a 1KB runtime bundle footprint Affected versions of this package are vulnerable to Prototype Pollution in the setNestedProperty function when processing translation catalog keys containing reserved properties such as proto, constructor, o...

GHSA-4C35-WCG5-MM9H next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

Summary setNestedProperty in packages/next-intl/src/extractor/utils.tsx walks a dotted key path and assigns the final value without blocking the reserved keys proto, constructor, or prototype. When the next-intl Next.js plugin is configured with experimental.messages and messages.precompile: true...