handlebars-lang

Thursday, October 8

• GitHub CVE-2026-106446
  Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

  • handlebars-lang handlebars.js
  • Critical
  • CVSS 9.8
  • EPSS 0.64%
  • Fixed version listed
  17:52 UTC
• GitHub CVE-2026-106445
  Handlebars: JavaScript Injection via Own Property Check Bypass

  • handlebars-lang handlebars.js
  • Critical
  • CVSS 9.2
  • EPSS 0.41%
  • Fixed version listed
  17:52 UTC