H
Vendor security profile
handlebars-lang
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs8
Critical3
CISA KEV0
Public exploit8
Patch rate%63
Avg. CVSS8.2
12-month vulnerability rate
0
0
0
0
5
0
0
0
0
0
0
3
CVE KEV
CVE severity distribution
8toplam CVE
Critical3 (38%)
High4 (50%)
Medium1 (13%)
Patch and exploitation view
%63
Verified patch
%0
CISA KEV
%100
Public exploit
5Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
9.8
CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
H
Patch status unknownEPSS %1
9.2
CVE-2026-106445
Handlebars: JavaScript Injection via Own Property Check Bypass
H
Patch status unknownEPSS %0
4.7
CVE-2026-106444
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
H
Patch status unknownEPSS %0
8.3
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
H
Patch verifiedEPSS %0
8.1
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
H
Patch verifiedEPSS %1
7.5
CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
H
Patch verifiedEPSS %1
8.1
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
H
Patch verifiedEPSS %1
9.8
CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
H
Patch verifiedEPSS %2