Handlebarsjs maintains a widely used templating library whose modest product footprint belies significant deployment breadth across web applications and Node.js environments. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and concentrate on template-processing mechanics, with recurring weakness classes including code injection, type confusion, cross-site scripting, prototype pollution, and improper exception handling that reflect the inherent risks of dynamic code generation and object manipulation in templating contexts. Defenders should treat this vendor's releases as high-priority despite its focused scope, given the library's position in application-rendering pipelines; current severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Handlebarsjs over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-33937CRITICAL Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition t | Mar 27, 2026 | 9.8 | 40 | NO | NO |
CVE-2021-23383CRITICAL The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. | May 4, 2021 | 9.8 | 33 | NO | NO |
CVE-2021-23369CRITICAL The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source. | Apr 12, 2021 | 9.8 | 33 | NO | NO |
CVE-2026-33941HIGH Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler. | Mar 27, 2026 | 8.2 | 32 | NO | NO |
CVE-2026-33938HIGH Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data | Mar 27, 2026 | 8.1 | 32 | NO | NO |
CVE-2026-33940HIGH Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all condi | Mar 27, 2026 | 8.1 | 31 | NO | NO |
CVE-2026-33939HIGH Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an | Mar 27, 2026 | 7.5 | 30 | NO | NO |
CVE-2019-20920HIGH Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templat | Sep 30, 2020 | 8.1 | 26 | NO | NO |
CVE-2019-20922HIGH Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templa | Sep 30, 2020 | 7.5 | 25 | NO | NO |
CVE-2026-33916MEDIUM Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names | Mar 27, 2026 | 4.7 | 19 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Handlebarsjs.
Media articles that mention a CVE ID that affects a product developed by Handlebarsjs — matched by CVE ID, not by vendor name.