{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-23T20:15:28.013Z",
  "lastRun": "2026-10-23T20:01:03.754Z",
  "liveDays": 14,
  "filters": {
    "kind": null,
    "exploited": false,
    "severity": null,
    "ecosystems": [],
    "tag": "handlebars-lang"
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incidents": [
    {
      "id": "cve-2026-106446",
      "url": "https://cveboard.org/i/cve-2026-106446",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-106446",
      "json": "https://cveboard.org/i/cve-2026-106446.json",
      "kind": "vuln",
      "live": false,
      "knownExploited": false,
      "severity": "critical",
      "title": "Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)",
      "summary": "Handlebars.compile() and Handlebars.precompile() accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked.",
      "titlePt": "Handlebars: Injeção de JavaScript via confusão de tipo AST em compile (contorno de CVE-2026-33937)",
      "summaryPt": "Handlebars.compile() e Handlebars.precompile() aceitam uma AST pré-analisada, bem como uma string de modelo. Handlebars 4.7.9 adicionou validação para tais ASTs. Ele verifica apenas os valores em nós PathExpression, NumberLiteral e BooleanLiteral, e o compilador ainda escreve vários outros valores AST no JavaScript gerado sem verificação.",
      "affected": [],
      "omitted": 0,
      "references": [
        {
          "url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
          "tag": "exploit"
        }
      ],
      "cwes": [
        {
          "id": "CWE-94",
          "name": "Improper Control of Generation of Code ('Code Injection')"
        },
        {
          "id": "CWE-843",
          "name": "Access of Resource Using Incompatible Type ('Type Confusion')"
        }
      ],
      "ssvc": {
        "exploitation": "poc",
        "automatable": "yes",
        "impact": "total",
        "at": "2026-10-07T18:27:28.577Z"
      },
      "fix": "listed",
      "tags": [
        "handlebars-lang",
        "npm"
      ],
      "cves": [
        "CVE-2026-106446"
      ],
      "ghsa": "GHSA-8r5x-fm3f-whwj",
      "cvss": {
        "score": 9.8,
        "version": "3.1",
        "by": "GitHub"
      },
      "epss": {
        "percentage": 0.0064,
        "percentile": 0.50067,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [
        {
          "ecosystem": "npm",
          "name": "handlebars",
          "vulnerable": ">= 4.0.0, <= 4.7.9",
          "fixed": "4.7.10",
          "advisory": "GHSA-8r5x-fm3f-whwj"
        }
      ],
      "vendor": "handlebars-lang",
      "product": "handlebars.js",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "GitHub Advisory Database",
          "url": "https://github.com/advisories/GHSA-8r5x-fm3f-whwj"
        }
      ],
      "cvePending": true,
      "publishedAt": "2026-10-08T17:52:32.000Z",
      "updatedAt": "2026-10-08T17:52:32.000Z"
    },
    {
      "id": "cve-2026-106445",
      "url": "https://cveboard.org/i/cve-2026-106445",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-106445",
      "json": "https://cveboard.org/i/cve-2026-106445.json",
      "kind": "vuln",
      "live": false,
      "knownExploited": false,
      "severity": "critical",
      "title": "Handlebars: JavaScript Injection via Own Property Check Bypass",
      "summary": "Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: true can inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.",
      "titlePt": "Handlebars: Injeção de JavaScript via contorno de verificação de propriedade própria",
      "summaryPt": "Handlebars pode expor o construtor Function apesar de sua lista de negação de acesso ao protótipo. Quando um modelo atinge Function.prototype, sua própria propriedade construtora é retornada antes da lista de negação ser verificada. Um atacante que puder renderizar um modelo controlado com allowProtoMethodsByDefault: true pode injetar e executar JavaScript arbitrário, levando à execução remota de código no servidor.",
      "affected": [],
      "omitted": 0,
      "references": [
        {
          "url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f",
          "tag": "exploit"
        }
      ],
      "cwes": [
        {
          "id": "CWE-184",
          "name": "Incomplete List of Disallowed Inputs"
        },
        {
          "id": "CWE-1289",
          "name": "Improper Validation of Unsafe Equivalence in Input"
        }
      ],
      "ssvc": {
        "exploitation": "poc",
        "automatable": "yes",
        "impact": "total",
        "at": "2026-10-09T01:42:53.531Z"
      },
      "fix": "listed",
      "tags": [
        "handlebars-lang",
        "npm"
      ],
      "cves": [
        "CVE-2026-106445"
      ],
      "ghsa": "GHSA-p8wg-vrv2-v86f",
      "cvss": {
        "score": 9.2,
        "version": "4.0",
        "by": "GitHub"
      },
      "epss": {
        "percentage": 0.00411,
        "percentile": 0.34307,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [
        {
          "ecosystem": "npm",
          "name": "handlebars",
          "vulnerable": ">= 3.0.0, <= 4.7.9",
          "fixed": "4.7.10",
          "advisory": "GHSA-p8wg-vrv2-v86f"
        }
      ],
      "vendor": "handlebars-lang",
      "product": "handlebars.js",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "GitHub Advisory Database",
          "url": "https://github.com/advisories/GHSA-p8wg-vrv2-v86f"
        }
      ],
      "cvePending": true,
      "publishedAt": "2026-10-08T17:52:26.000Z",
      "updatedAt": "2026-10-08T17:52:26.000Z"
    }
  ],
  "tag": {
    "tag": "handlebars-lang",
    "name": "handlebars-lang",
    "kev": null
  }
}