handlebarsjs has 5 CVEs on record. The busiest recent month was March 2026 with 5. The median CVSS is 8.1 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-94 (4) and CWE-843 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 5
Worst active — by depth score
CVE-2026-33937Critical· 9.8Handlebars provides the power necessary to let users build semantic templates66CVE-2026-33941High· 8.2Handlebars provides the power necessary to let users build semantic templates57CVE-2026-33940High· 8.1Handlebars provides the power necessary to let users build semantic templates45CVE-2026-33938High· 8.1Handlebars provides the power necessary to let users build semantic templates45CVE-2026-33939High· 7.5Handlebars provides the power necessary to let users build semantic templates41
handlebarsjs vulnerabilities
CVEs affecting handlebarsjs, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-33941High· 8.2PoCHandlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file…
CVE-2026-33940High· 8.1Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePart…
CVE-2026-33939High· 7.5Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled temp…
CVE-2026-33938High· 8.1Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a templ…
CVE-2026-33937Critical· 9.8PoCHandlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLitera…