H
Vendor security profile
handlebarsjs
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs8
Critical1
CISA KEV0
Public exploit8
Patch rate%88
Avg. CVSS7.6
12-month vulnerability rate
0
0
0
0
5
0
0
0
0
0
0
0
CVE KEV
CVE severity distribution
8toplam CVE
Critical1 (13%)
High5 (63%)
Medium2 (25%)
Patch and exploitation view
%88
Verified patch
%0
CISA KEV
%100
Public exploit
7Patch available
0Partial
0Workaround
0Vendor: no patch
1Unknown
Latest vulnerabilities
8.3
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
H
Patch verifiedEPSS %0
8.1
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
H
Patch verifiedEPSS %1
7.5
CVE-2026-33939
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
H
Patch verifiedEPSS %1
8.1
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
H
Patch verifiedEPSS %1
9.8
CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
H
Patch verifiedEPSS %2
5.6
CVE-2021-23383
Prototype Pollution
N
Patch verifiedEPSS %5
5.6
CVE-2021-23369
Remote Code Execution (RCE)
N
Patch verifiedEPSS %7
8.1
CVE-2019-20920
Vulnerability in N/a
N
Patch status unknownEPSS %3