{"schema_version":1,"title":"Handlebars vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Handlebars: 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-106445, was published on 6 October 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. 0 critical against 1.","url":"https://junglewise.ai/threats/technologies/handlebars-handlebars","json_url":"https://junglewise.ai/threats/technologies/handlebars-handlebars.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/handlebars-handlebars","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":9,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":2},"latest":[{"cve":"CVE-2026-106445","cvss":4,"epss":0.0041,"slug":"cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars prototype pollution RCE via constructor bypass","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:26.293+00:00","url":"https://junglewise.ai/threats/cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build"},{"cvss":3.1,"slug":"handlebars-js-property-access-validation-bypass-in-container-lookup-25bcfec0","title":"Handlebars.js property access validation bypass in container.lookup","severity":"low","exploited":false,"published_at":"2026-03-29T15:16:37+00:00","url":"https://junglewise.ai/threats/handlebars-js-property-access-validation-bypass-in-container-lookup-25bcfec0"},{"cve":"CVE-2021-23383","cvss":3.1,"epss":0.0451,"slug":"cve-2021-23383-handlebars-prototype-pollution-in-template-compilation","title":"Handlebars prototype pollution in template compilation","severity":"low","exploited":false,"published_at":"2022-02-10T23:51:42+00:00","url":"https://junglewise.ai/threats/cve-2021-23383-handlebars-prototype-pollution-in-template-compilation"},{"cve":"CVE-2019-20922","cvss":3.1,"epss":0.0379,"slug":"cve-2019-20922-handlebars-regular-expression-denial-of-service","title":"Handlebars regular expression denial of service","severity":"low","exploited":false,"published_at":"2022-02-10T20:38:22+00:00","url":"https://junglewise.ai/threats/cve-2019-20922-handlebars-regular-expression-denial-of-service"},{"slug":"handlebars-arbitrary-code-execution-via-lookup-helper-739dd450","title":"Handlebars arbitrary code execution via lookup helper","severity":"info","exploited":false,"published_at":"2020-09-04T15:07:38+00:00","url":"https://junglewise.ai/threats/handlebars-arbitrary-code-execution-via-lookup-helper-739dd450"},{"cvss":7.5,"slug":"handlebars-prototype-pollution-in-template-processing-676d30e6","title":"Handlebars prototype pollution in template processing","severity":"info","exploited":false,"published_at":"2020-09-04T15:06:32+00:00","url":"https://junglewise.ai/threats/handlebars-prototype-pollution-in-template-processing-676d30e6"},{"slug":"handlebars-denial-of-service-in-template-parser-7f538b11","title":"Handlebars Denial of Service in template parser","severity":"info","exploited":false,"published_at":"2020-09-03T23:20:12+00:00","url":"https://junglewise.ai/threats/handlebars-denial-of-service-in-template-parser-7f538b11"},{"cvss":3.1,"slug":"handlebars-prototype-pollution-remote-code-execution-cfff4bd0","title":"Handlebars prototype pollution remote code execution","severity":"low","exploited":false,"published_at":"2019-06-05T14:07:48+00:00","url":"https://junglewise.ai/threats/handlebars-prototype-pollution-remote-code-execution-cfff4bd0"},{"slug":"handlebars-moderate-severity-vulnerability-withdrawn-cad4e97e","title":"Handlebars moderate severity vulnerability (withdrawn)","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:36+00:00","url":"https://junglewise.ai/threats/handlebars-moderate-severity-vulnerability-withdrawn-cad4e97e"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Handlebars.js","slug":"handlebars-handlebars-js","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/handlebars-handlebars-js"}],"technology":{"hub":true,"name":"Handlebars","slug":"handlebars-handlebars","vendor":{"hub":true,"name":"Handlebars","slug":"handlebars","url":"https://junglewise.ai/threats/vendors/handlebars"},"aliases":[],"category":"template-engine","description":"JavaScript templating language and engine for generating dynamic HTML and text content.","url":"https://junglewise.ai/threats/technologies/handlebars-handlebars"},"most_severe":[{"cve":"CVE-2026-106445","cvss":4,"epss":0.0041,"slug":"cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars prototype pollution RCE via constructor bypass","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:26.293+00:00","url":"https://junglewise.ai/threats/cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build"},{"cve":"CVE-2021-23383","cvss":3.1,"epss":0.0451,"slug":"cve-2021-23383-handlebars-prototype-pollution-in-template-compilation","title":"Handlebars prototype pollution in template compilation","severity":"low","exploited":false,"published_at":"2022-02-10T23:51:42+00:00","url":"https://junglewise.ai/threats/cve-2021-23383-handlebars-prototype-pollution-in-template-compilation"},{"cve":"CVE-2019-20922","cvss":3.1,"epss":0.0379,"slug":"cve-2019-20922-handlebars-regular-expression-denial-of-service","title":"Handlebars regular expression denial of service","severity":"low","exploited":false,"published_at":"2022-02-10T20:38:22+00:00","url":"https://junglewise.ai/threats/cve-2019-20922-handlebars-regular-expression-denial-of-service"},{"cvss":3.1,"slug":"handlebars-js-property-access-validation-bypass-in-container-lookup-25bcfec0","title":"Handlebars.js property access validation bypass in container.lookup","severity":"low","exploited":false,"published_at":"2026-03-29T15:16:37+00:00","url":"https://junglewise.ai/threats/handlebars-js-property-access-validation-bypass-in-container-lookup-25bcfec0"},{"cvss":3.1,"slug":"handlebars-prototype-pollution-remote-code-execution-cfff4bd0","title":"Handlebars prototype pollution remote code execution","severity":"low","exploited":false,"published_at":"2019-06-05T14:07:48+00:00","url":"https://junglewise.ai/threats/handlebars-prototype-pollution-remote-code-execution-cfff4bd0"},{"cvss":7.5,"slug":"handlebars-prototype-pollution-in-template-processing-676d30e6","title":"Handlebars prototype pollution in template processing","severity":"info","exploited":false,"published_at":"2020-09-04T15:06:32+00:00","url":"https://junglewise.ai/threats/handlebars-prototype-pollution-in-template-processing-676d30e6"},{"slug":"handlebars-arbitrary-code-execution-via-lookup-helper-739dd450","title":"Handlebars arbitrary code execution via lookup helper","severity":"info","exploited":false,"published_at":"2020-09-04T15:07:38+00:00","url":"https://junglewise.ai/threats/handlebars-arbitrary-code-execution-via-lookup-helper-739dd450"},{"slug":"handlebars-denial-of-service-in-template-parser-7f538b11","title":"Handlebars Denial of Service in template parser","severity":"info","exploited":false,"published_at":"2020-09-03T23:20:12+00:00","url":"https://junglewise.ai/threats/handlebars-denial-of-service-in-template-parser-7f538b11"},{"slug":"handlebars-moderate-severity-vulnerability-withdrawn-cad4e97e","title":"Handlebars moderate severity vulnerability (withdrawn)","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:36+00:00","url":"https://junglewise.ai/threats/handlebars-moderate-severity-vulnerability-withdrawn-cad4e97e"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}