StackPrism

npm package

handlebars vulnerabilities by version

The latest release, 4.7.10 (Oct 5, 2026), has no known vulnerabilities. 83% of last week’s 43.4M downloads went to versions with known vulnerabilities. OSV.dev lists 22 advisories for handlebars; the newest was published on Oct 8, 2026.

npm (opens in a new tab) describes it as “Handlebars provides the power necessary to let you build semantic templates effectively with no frustration”

Latest release
4.7.10
Oct 5, 2026, no known vulnerabilities
Downloads last week
43.4M
All versions, from npm
Advisories on OSV.dev
22
Newest Oct 8, 2026
Licence
MIT
OpenSSF Scorecard
5.2/10
handlebars-lang/handlebars.js (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
4.7.9Mar 26, 20263 known vulnerabilities, worst rated critical23.5M
4.7.8Aug 1, 202311 known vulnerabilities, worst rated critical8.6M
4.7.10latestOct 5, 2026No known vulnerabilities7.5M
4.7.7Feb 15, 202111 known vulnerabilities, worst rated critical2.4M
4.7.6Apr 3, 202013 known vulnerabilities, worst rated critical262.2K
4.0.11Oct 17, 201720 known vulnerabilities, worst rated critical198K
4.1.2Apr 13, 201919 known vulnerabilities, worst rated critical153.4K
4.5.3Nov 18, 201912 known vulnerabilities, worst rated critical121.3K

Who is still on a vulnerable handlebars

83% of last week’s 43.4M handlebars downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. handlebars doesn’t publish support dates we can check.

LineNewest releaseReleased
44.7.10Oct 5, 2026
33.0.8Feb 23, 2020
22.0.0Sep 2, 2014
11.3.0Jan 2, 2014

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-106444 on OSV.dev (opens in a new tab)GHSA-xw65-4hp5-5hc7

    Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

    Affects >= 4.0.0, < 4.7.10. Published Oct 8, 2026.

  2. CriticalCVE-2026-106446 on OSV.dev (opens in a new tab)GHSA-8r5x-fm3f-whwj

    Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

    Affects >= 4.0.0, < 4.7.10. Published Oct 8, 2026.

  3. CriticalCVE-2026-106445 on OSV.dev (opens in a new tab)GHSA-p8wg-vrv2-v86f

    Handlebars: JavaScript Injection via Own Property Check Bypass

    Affects >= 3.0.0, < 4.7.10. Published Oct 8, 2026.

  4. WarningGHSA-7rx3-28cr-v5wh on OSV.dev (opens in a new tab)

    Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry

    Affects >= 4.6.0, < 4.7.9. Published Mar 29, 2026.

  5. LowGHSA-442j-39wm-28r2 on OSV.dev (opens in a new tab)

    Handlebars.js has a Property Access Validation Bypass in container.lookup

    Affects >= 4.0.0, < 4.7.9. Published Mar 29, 2026.

All 22 advisories are on OSV.dev (opens in a new tab).

Which handlebars do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for handlebars, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.