{"schema_version":1,"title":"handlebars (npm) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 17 vulnerabilities in handlebars (npm): 0 in the last 7 days and 3 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-106446, was published on 6 October 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. 0 critical against 2.","url":"https://junglewise.ai/threats/technologies/npm-handlebars","json_url":"https://junglewise.ai/threats/technologies/npm-handlebars.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/npm-handlebars","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":17,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":3,"last_365_days":8},"latest":[{"cve":"CVE-2026-106446","cvss":9.8,"epss":0.0064,"slug":"cve-2026-106446-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars AST validation bypass in compile and precompile","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:26.43+00:00","url":"https://junglewise.ai/threats/cve-2026-106446-handlebars-provides-the-power-necessary-to-let-users-build"},{"cve":"CVE-2026-106445","cvss":4,"epss":0.0041,"slug":"cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars prototype pollution RCE via constructor bypass","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:26.293+00:00","url":"https://junglewise.ai/threats/cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build"},{"cve":"CVE-2026-106444","cvss":4.7,"epss":0.0029,"slug":"cve-2026-106444-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars precompile script injection in generated code","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:26.13+00:00","url":"https://junglewise.ai/threats/cve-2026-106444-handlebars-provides-the-power-necessary-to-let-users-build"},{"cvss":3.1,"slug":"handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407","title":"Handlebars.js prototype method access control gap via missing __lookupSetter__","severity":"low","exploited":false,"published_at":"2026-03-29T15:17:15+00:00","url":"https://junglewise.ai/threats/handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407"},{"cvss":3.1,"slug":"handlebars-js-property-access-validation-bypass-in-container-lookup-25bcfec0","title":"Handlebars.js property access validation bypass in container.lookup","severity":"low","exploited":false,"published_at":"2026-03-29T15:16:37+00:00","url":"https://junglewise.ai/threats/handlebars-js-property-access-validation-bypass-in-container-lookup-25bcfec0"},{"cve":"CVE-2026-33941","cvss":8.2,"epss":0.0022,"slug":"cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler","title":"Handlebars handlebars.js code injection in CLI precompiler","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.203+00:00","url":"https://junglewise.ai/threats/cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler"},{"cve":"CVE-2026-33940","cvss":8.1,"epss":0.0079,"slug":"cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion","title":"Handlebars.js remote code execution via AST type confusion","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.03+00:00","url":"https://junglewise.ai/threats/cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion"},{"cve":"CVE-2026-33939","cvss":7.5,"epss":0.0076,"slug":"cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax","title":"Handlebars.js denial of service via malformed decorator syntax","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:20.857+00:00","url":"https://junglewise.ai/threats/cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax"},{"cve":"CVE-2021-23383","cvss":3.1,"epss":0.0451,"slug":"cve-2021-23383-handlebars-prototype-pollution-in-template-compilation","title":"Handlebars prototype pollution in template compilation","severity":"low","exploited":false,"published_at":"2022-02-10T23:51:42+00:00","url":"https://junglewise.ai/threats/cve-2021-23383-handlebars-prototype-pollution-in-template-compilation"},{"cve":"CVE-2019-20922","cvss":3.1,"epss":0.0379,"slug":"cve-2019-20922-handlebars-regular-expression-denial-of-service","title":"Handlebars regular expression denial of service","severity":"low","exploited":false,"published_at":"2022-02-10T20:38:22+00:00","url":"https://junglewise.ai/threats/cve-2019-20922-handlebars-regular-expression-denial-of-service"},{"slug":"handlebars-arbitrary-code-execution-via-lookup-helper-739dd450","title":"Handlebars arbitrary code execution via lookup helper","severity":"info","exploited":false,"published_at":"2020-09-04T15:07:38+00:00","url":"https://junglewise.ai/threats/handlebars-arbitrary-code-execution-via-lookup-helper-739dd450"},{"cvss":7.5,"slug":"handlebars-prototype-pollution-in-template-processing-676d30e6","title":"Handlebars prototype pollution in template processing","severity":"info","exploited":false,"published_at":"2020-09-04T15:06:32+00:00","url":"https://junglewise.ai/threats/handlebars-prototype-pollution-in-template-processing-676d30e6"},{"slug":"handlebars-denial-of-service-in-template-parser-7f538b11","title":"Handlebars Denial of Service in template parser","severity":"info","exploited":false,"published_at":"2020-09-03T23:20:12+00:00","url":"https://junglewise.ai/threats/handlebars-denial-of-service-in-template-parser-7f538b11"},{"slug":"handlebars-js-remote-code-execution-via-template-injection-c5d2b812","title":"Handlebars.js remote code execution via template injection","severity":"info","exploited":false,"published_at":"2019-07-15T19:46:01+00:00","url":"https://junglewise.ai/threats/handlebars-js-remote-code-execution-via-template-injection-c5d2b812"},{"cvss":3.1,"slug":"handlebars-prototype-pollution-remote-code-execution-cfff4bd0","title":"Handlebars prototype pollution remote code execution","severity":"low","exploited":false,"published_at":"2019-06-05T14:07:48+00:00","url":"https://junglewise.ai/threats/handlebars-prototype-pollution-remote-code-execution-cfff4bd0"},{"slug":"handlebars-moderate-severity-vulnerability-withdrawn-cad4e97e","title":"Handlebars moderate severity vulnerability (withdrawn)","severity":"info","exploited":false,"published_at":"2017-10-24T18:33:36+00:00","url":"https://junglewise.ai/threats/handlebars-moderate-severity-vulnerability-withdrawn-cad4e97e"},{"cve":"CVE-2015-8861","cvss":6.1,"epss":0.0261,"slug":"cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes","title":"Handlebars.js XSS in unquoted template attributes","severity":"medium","exploited":false,"published_at":"2017-01-23T21:59:00.72+00:00","url":"https://junglewise.ai/threats/cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":2,"exploited":0,"vulnerabilities":3},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"openclaw (npm)","slug":"npm-openclaw","vulnerabilities":214,"url":"https://junglewise.ai/threats/technologies/npm-openclaw"},{"name":"flowise (npm)","slug":"flowise","vulnerabilities":133,"url":"https://junglewise.ai/threats/technologies/flowise"},{"name":"parse-server (npm)","slug":"parse-server","vulnerabilities":117,"url":"https://junglewise.ai/threats/technologies/parse-server"},{"name":"vm2 (npm)","slug":"vm2","vulnerabilities":111,"url":"https://junglewise.ai/threats/technologies/vm2"},{"name":"electron (npm)","slug":"electron","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/electron"},{"name":"ghost (npm)","slug":"ghost","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/ghost"},{"name":"n8n (npm)","slug":"npm-n8n","vulnerabilities":64,"url":"https://junglewise.ai/threats/technologies/npm-n8n"},{"name":"hono (npm)","slug":"hono","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/hono"},{"name":"directus (npm)","slug":"directus","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/directus"},{"name":"nocodb (npm)","slug":"nocodb","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/nocodb"},{"name":"undici (npm)","slug":"undici","vulnerabilities":53,"url":"https://junglewise.ai/threats/technologies/undici"},{"name":"@budibase/server (npm)","slug":"budibase-server","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/budibase-server"}],"technology":{"hub":true,"name":"handlebars (npm)","slug":"npm-handlebars","vendor":{"hub":true,"name":"npm","slug":"npm","url":"https://junglewise.ai/threats/vendors/npm"},"aliases":[],"homepage":"https://handlebarsjs.com/","description":"JavaScript templating engine for rendering dynamic content using handlebars syntax.","url":"https://junglewise.ai/threats/technologies/npm-handlebars"},"most_severe":[{"cve":"CVE-2026-106446","cvss":9.8,"epss":0.0064,"slug":"cve-2026-106446-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars AST validation bypass in compile and precompile","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:26.43+00:00","url":"https://junglewise.ai/threats/cve-2026-106446-handlebars-provides-the-power-necessary-to-let-users-build"},{"cve":"CVE-2026-106445","cvss":4,"epss":0.0041,"slug":"cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars prototype pollution RCE via constructor bypass","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:26.293+00:00","url":"https://junglewise.ai/threats/cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build"},{"cve":"CVE-2026-33941","cvss":8.2,"epss":0.0022,"slug":"cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler","title":"Handlebars handlebars.js code injection in CLI precompiler","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.203+00:00","url":"https://junglewise.ai/threats/cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler"},{"cve":"CVE-2026-33940","cvss":8.1,"epss":0.0079,"slug":"cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion","title":"Handlebars.js remote code execution via AST type confusion","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:21.03+00:00","url":"https://junglewise.ai/threats/cve-2026-33940-handlebars-js-remote-code-execution-via-ast-type-confusion"},{"cve":"CVE-2026-33939","cvss":7.5,"epss":0.0076,"slug":"cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax","title":"Handlebars.js denial of service via malformed decorator syntax","severity":"high","exploited":false,"published_at":"2026-03-27T22:16:20.857+00:00","url":"https://junglewise.ai/threats/cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax"},{"cve":"CVE-2015-8861","cvss":6.1,"epss":0.0261,"slug":"cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes","title":"Handlebars.js XSS in unquoted template attributes","severity":"medium","exploited":false,"published_at":"2017-01-23T21:59:00.72+00:00","url":"https://junglewise.ai/threats/cve-2015-8861-handlebars-js-xss-in-unquoted-template-attributes"},{"cve":"CVE-2026-106444","cvss":4.7,"epss":0.0029,"slug":"cve-2026-106444-handlebars-provides-the-power-necessary-to-let-users-build","title":"Handlebars precompile script injection in generated code","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:26.13+00:00","url":"https://junglewise.ai/threats/cve-2026-106444-handlebars-provides-the-power-necessary-to-let-users-build"},{"cve":"CVE-2021-23383","cvss":3.1,"epss":0.0451,"slug":"cve-2021-23383-handlebars-prototype-pollution-in-template-compilation","title":"Handlebars prototype pollution in template compilation","severity":"low","exploited":false,"published_at":"2022-02-10T23:51:42+00:00","url":"https://junglewise.ai/threats/cve-2021-23383-handlebars-prototype-pollution-in-template-compilation"},{"cve":"CVE-2019-20922","cvss":3.1,"epss":0.0379,"slug":"cve-2019-20922-handlebars-regular-expression-denial-of-service","title":"Handlebars regular expression denial of service","severity":"low","exploited":false,"published_at":"2022-02-10T20:38:22+00:00","url":"https://junglewise.ai/threats/cve-2019-20922-handlebars-regular-expression-denial-of-service"},{"cvss":3.1,"slug":"handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407","title":"Handlebars.js prototype method access control gap via missing __lookupSetter__","severity":"low","exploited":false,"published_at":"2026-03-29T15:17:15+00:00","url":"https://junglewise.ai/threats/handlebars-js-prototype-method-access-control-gap-via-missing-f97c2407"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}