{"schema_version":1,"title":"Handlebars.js Project Handlebars.js vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Handlebars.js Project Handlebars.js: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, Handlebars.js prototype method access control gap via missing __lookupSetter__, was published on 29 March 2026.","url":"https://junglewise.ai/threats/technologies/handlebars-js","json_url":"https://junglewise.ai/threats/technologies/handlebars-js.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/handlebars-js","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":4,"all_time":9,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":6},"latest":[{"cvss":3.1,"slug":"handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407","title":"Handlebars.js prototype method access control gap via missing __lookupSetter__","severity":"low","exploited":false,"published_at":"2026-03-29T15:17:15+00:00","url":"https://junglewise.ai/threats/handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407"},{"cve":"CVE-2026-33941","cvss":8.2,"epss":0.0022,"slug":"cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler","title":"Handlebars handlebars.js code injection in CLI precompiler","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.203+00:00","url":"https://junglewise.ai/threats/cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler"},{"cve":"CVE-2026-33940","cvss":8.1,"epss":0.0079,"slug":"cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion","title":"Handlebars.js remote code execution via AST type confusion","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.03+00:00","url":"https://junglewise.ai/threats/cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion"},{"cve":"CVE-2026-33939","cvss":7.5,"epss":0.0076,"slug":"cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax","title":"Handlebars.js denial of service via malformed decorator syntax","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:20.857+00:00","url":"https://junglewise.ai/threats/cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax"},{"cve":"CVE-2026-33938","cvss":8.1,"epss":0.0084,"slug":"cve-2026-33938-handlebars-js-remote-code-execution-via-partial-block-ast","title":"Handlebars.js remote code execution via @partial-block AST injection","severity":"high","exploited":false,"published_at":"2026-03-27T21:17:27.587+00:00","url":"https://junglewise.ai/threats/cve-2026-33938-handlebars-js-remote-code-execution-via-partial-block-ast"},{"cve":"CVE-2026-33937","cvss":9.8,"epss":0.0174,"slug":"cve-2026-33937-handlebars-js-remote-code-execution-via-ast-type-confusion-in","title":"Handlebars.js remote code execution via AST type confusion in compile","severity":"critical","exploited":false,"published_at":"2026-03-27T21:17:27.417+00:00","url":"https://junglewise.ai/threats/cve-2026-33937-handlebars-js-remote-code-execution-via-ast-type-confusion-in"},{"cve":"CVE-2021-23369","cvss":3.1,"epss":0.0703,"slug":"cve-2021-23369-handlebars-remote-code-execution-in-template-compilation","title":"Handlebars remote code execution in template compilation","severity":"low","exploited":false,"published_at":"2021-05-06T15:57:44+00:00","url":"https://junglewise.ai/threats/cve-2021-23369-handlebars-remote-code-execution-in-template-compilation"},{"slug":"handlebars-js-remote-code-execution-via-template-injection-c5d2b812","title":"Handlebars.js remote code execution via template injection","severity":"info","exploited":false,"published_at":"2019-07-15T19:46:01+00:00","url":"https://junglewise.ai/threats/handlebars-js-remote-code-execution-via-template-injection-c5d2b812"},{"cve":"CVE-2015-8861","cvss":6.1,"epss":0.0261,"slug":"cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes","title":"Handlebars.js XSS in unquoted template attributes","severity":"medium","exploited":false,"published_at":"2017-01-23T21:59:00.72+00:00","url":"https://junglewise.ai/threats/cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Handlebars.js Project Handlebars.js","slug":"handlebars-js","vendor":{"name":"Handlebars.js Project","slug":"handlebars-js-project","url":"https://junglewise.ai/threats/vendors/handlebars-js-project"},"aliases":[],"homepage":"https://handlebarsjs.com/","repo_url":"https://github.com/handlebars-lang/handlebars.js","description":"An extension to the Mustache templating language for building semantic templates.","url":"https://junglewise.ai/threats/technologies/handlebars-js"},"most_severe":[{"cve":"CVE-2026-33937","cvss":9.8,"epss":0.0174,"slug":"cve-2026-33937-handlebars-js-remote-code-execution-via-ast-type-confusion-in","title":"Handlebars.js remote code execution via AST type confusion in compile","severity":"critical","exploited":false,"published_at":"2026-03-27T21:17:27.417+00:00","url":"https://junglewise.ai/threats/cve-2026-33937-handlebars-js-remote-code-execution-via-ast-type-confusion-in"},{"cve":"CVE-2026-33941","cvss":8.2,"epss":0.0022,"slug":"cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler","title":"Handlebars handlebars.js code injection in CLI precompiler","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.203+00:00","url":"https://junglewise.ai/threats/cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler"},{"cve":"CVE-2026-33938","cvss":8.1,"epss":0.0084,"slug":"cve-2026-33938-handlebars-js-remote-code-execution-via-partial-block-ast","title":"Handlebars.js remote code execution via @partial-block AST injection","severity":"high","exploited":false,"published_at":"2026-03-27T21:17:27.587+00:00","url":"https://junglewise.ai/threats/cve-2026-33938-handlebars-js-remote-code-execution-via-partial-block-ast"},{"cve":"CVE-2026-33940","cvss":8.1,"epss":0.0079,"slug":"cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion","title":"Handlebars.js remote code execution via AST type confusion","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.03+00:00","url":"https://junglewise.ai/threats/cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion"},{"cve":"CVE-2026-33939","cvss":7.5,"epss":0.0076,"slug":"cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax","title":"Handlebars.js denial of service via malformed decorator syntax","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:20.857+00:00","url":"https://junglewise.ai/threats/cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax"},{"cve":"CVE-2015-8861","cvss":6.1,"epss":0.0261,"slug":"cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes","title":"Handlebars.js XSS in unquoted template attributes","severity":"medium","exploited":false,"published_at":"2017-01-23T21:59:00.72+00:00","url":"https://junglewise.ai/threats/cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes"},{"cve":"CVE-2021-23369","cvss":3.1,"epss":0.0703,"slug":"cve-2021-23369-handlebars-remote-code-execution-in-template-compilation","title":"Handlebars remote code execution in template compilation","severity":"low","exploited":false,"published_at":"2021-05-06T15:57:44+00:00","url":"https://junglewise.ai/threats/cve-2021-23369-handlebars-remote-code-execution-in-template-compilation"},{"cvss":3.1,"slug":"handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407","title":"Handlebars.js prototype method access control gap via missing __lookupSetter__","severity":"low","exploited":false,"published_at":"2026-03-29T15:17:15+00:00","url":"https://junglewise.ai/threats/handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407"},{"slug":"handlebars-js-remote-code-execution-via-template-injection-c5d2b812","title":"Handlebars.js remote code execution via template injection","severity":"info","exploited":false,"published_at":"2019-07-15T19:46:01+00:00","url":"https://junglewise.ai/threats/handlebars-js-remote-code-execution-via-template-injection-c5d2b812"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}