handlebars

Security advisories11

• handlebars: Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injectionfixed in 4.7.9
• handlebars: Handlebars.js has JavaScript Injection via AST Type Confusionfixed in 4.7.9
• handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockfixed in 4.7.9
• handlebars: Handlebars.js has a Property Access Validation Bypass in container.lookupfixed in 4.7.9
• handlebars: Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entryfixed in 4.7.9
• handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)fixed in 4.7.10
• handlebars: Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilationfixed in 4.7.9
• handlebars: Handlebars: JavaScript Injection via Own Property Check Bypassfixed in 4.7.10
• handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialfixed in 4.7.9
• handlebars: Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Optionsfixed in 4.7.9
• handlebars: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templatesfixed in 4.7.10

Versions that change something