Handlebars vulnerabilitiesHandlebars: known vulnerabilities and safe versions
npm: handlebars
Handlebars has 25 known vulnerability records: 22 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 3 only in Retire.js (CDN builds and advisories without a CVE).
By branch: 4.x is safe from 4.7.10; 3.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 4.x | — | — | 23critical | 4.7.10 |
| 3.x | — | — | 11critical | No fix |
Support dates appear only for libraries that endoflife.date tracks.
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2026-1064462026-10-06
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
Affected versions: >= 4.0.0, < 4.7.10
critical 9.8
Fixed in: 4.7.10
CVE-2026-106445exploit code exists2026-10-06
Handlebars: JavaScript Injection via Own Property Check Bypass
Affected versions: >= 3.0.0, < 4.7.10
critical 9.2
Fixed in: 4.7.10
CVE-2026-1064442026-10-06
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Affected versions: >= 4.0.0, < 4.7.10
medium 4.7
Fixed in: 4.7.10
GHSA-7rx3-28cr-v5wh2026-03-29
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
Affected versions: >= 4.6.0, < 4.7.9
medium 4.8
Fixed in: 4.7.9
GHSA-442j-39wm-28r22026-03-29
Handlebars.js has a Property Access Validation Bypass in container.lookup
Affected versions: >= 4.0.0, < 4.7.9
low 3.7
Fixed in: 4.7.9
CVE-2026-339412026-03-27
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Affected versions: >= 4.0.0, < 4.7.9
high 8.2
Fixed in: 4.7.9
CVE-2026-339402026-03-27
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Affected versions: >= 4.0.0, < 4.7.9
high 8.1
Fixed in: 4.7.9
CVE-2026-339392026-03-27
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Affected versions: >= 4.0.0, < 4.7.9
high 7.5
Fixed in: 4.7.9
CVE-2026-339382026-03-27
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
Affected versions: >= 4.0.0, < 4.7.9
high 8.1
Fixed in: 4.7.9
CVE-2026-33937exploit code exists2026-03-27
Handlebars.js has JavaScript Injection via AST Type Confusion
Affected versions: >= 4.0.0, < 4.7.9
critical 9.8
Fixed in: 4.7.9
EPSS 1.9%
CVE-2026-339162026-03-27
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Affected versions: >= 4.0.0, < 4.7.9
medium 4.7
Fixed in: 4.7.9
CVE-2021-23383exploit code exists2021-05-04
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi
Affected versions: < 4.7.7
critical 9.8
Fixed in: 4.7.7
EPSS 4.5%
critical 9.8
Fixed in: 4.7.7
EPSS 7%
CVE-2019-209222020-09-30
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching.
Affected versions: >= 4.0.0, < 4.4.5
high 7.5
Fixed in: 4.4.5
EPSS 3.6%
CVE-2019-209202020-09-30
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.
Affected versions: < 3.0.8 · >= 4.0.0, < 4.5.3
high 8.1
Fixed in: 3.0.8, 4.5.3
EPSS 3.1%
GHSA-q2c6-c6pm-g3gh2020-09-04
Arbitrary Code Execution in handlebars
Affected versions: < 3.0.8 · >= 4.0.0, < 4.5.3
high
Fixed in: 3.0.8, 4.5.3
GHSA-g9r4-xpmj-mj652020-09-04
Prototype Pollution in handlebars
Affected versions: < 3.0.8 · >= 4.0.0, < 4.5.3
high
Fixed in: 3.0.8, 4.5.3
GHSA-2cf5-4w76-r9qv2020-09-04
Arbitrary Code Execution in handlebars
Affected versions: < 3.0.8 · >= 4.0.0, < 4.5.2
high 7.3
Fixed in: 3.0.8, 4.5.2
medium
Fixed in: 4.4.5
CVE-2019-19919exploit code exists2019-12-20
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.
Affected versions: >= 4.0.0, < 4.3.0 · < 3.0.8
critical 9.8
Fixed in: 3.0.8, 4.3.0
EPSS 7%
GHSA-q42p-pg8m-cqh62019-06-05
Prototype Pollution in handlebars
Affected versions: >= 4.1.0, < 4.1.2 · >= 4.0.0, < 4.0.14 · < 3.0.7
high 7.3
Fixed in: 3.0.7, 4.0.14, 4.1.2
CVE-2015-88612017-01-23
The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a templa
Affected versions: < 4.0.0
medium 6.1
Fixed in: 4.0.0
EPSS 2.6%
no CVE
Denial of service
Affected versions: < 4.6.0
medium
Fixed in: 4.6.0
no CVE
A prototype pollution vulnerability in handlebars is exploitable if an attacker can control the template
Affected versions: >= 4.0.0, < 4.0.13
high
Fixed in: 4.0.13
no CVE
poorly sanitized input passed to eval()
Affected versions: < 1.0.0.beta.3
medium
Fixed in: 1.0.0.beta.3
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 26, 2026.