handlebars
npm
SEMVER · introduced 0 → fixed 4.7.7
GHSA-f2jv-r9rf-7988Published
Remote code execution in handlebars when compiling templates
Exact source revision recorded 24 Oct 2026 13:17:17 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-f2jv-r9rf-7988
Publishedorg.webjars:handlebars
Maven
ECOSYSTEM · introduced 0 → fixed 4.7.7
21 explicitly affected versions
1.0.0, 1.0.0-rc.3, 1.0.0-rc.4, 1.0.rc.1, 1.1.2, 1.2.1, 1.3.0, 2.0.0, 2.0.0-1, 2.0.0-alpha.2, 3.0.0, 3.0.0-1, 3.0.3, 4.0.11, 4.0.11-1, 4.0.13, 4.0.14, 4.0.2, 4.0.5, 4.0.6, 4.7.6
org.webjars.npm:handlebars
Maven
ECOSYSTEM · introduced 0 → fixed 4.7.7
21 explicitly affected versions
1.3.0, 2.0.0, 3.0.0, 3.0.1, 3.0.3, 4.0.11, 4.0.12, 4.0.14, 4.0.2, 4.0.5, 4.0.6, 4.1.1, 4.1.2, 4.2.1, 4.3.1, 4.4.0, 4.4.5, 4.5.3, 4.7.2, 4.7.3, 4.7.6
org.webjars.bowergithub.wycats:handlebars.js
Maven
ECOSYSTEM · introduced 0 → fixed 4.7.7
5 explicitly affected versions
4.1.1, 4.2.0, 4.4.5, 4.5.3, 4.7.2
Original source record · Cite this exact observation · Complete original publisher JSON