Skip to content

Vendor

handlebars.js project vulnerabilities

2 published CVES affecting handlebars.js project, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
1
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of handlebars.js project alerts

Products

Latest handlebars.js project CVEs

Newest publication first

  1. CVE-2019-19919 Prototype Pollution in handlebars

    Published
    CriticalCVSS 9.8 EPSS 7.1% PoC

    Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

  2. CVE-2015-8861 Cross-Site Scripting in handlebars

    Published
    MediumCVSS 6.1 EPSS 2.6%

    The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.