`handlebars`

Ecosystem:
npm

Package URL:
pkg:npm/handlebars

Total PRs:
2,433 Dependabot PRs

Latest PR:
3 days ago

Unique Repositories:
1,868 repositories

Unique Repos (30 days):
5 repositories

Security Advisories

Arbitrary Code Execution in handlebars

GHSA-2cf5-4w76-r9qv HIGH published almost 6 years ago • updated 4 months ago

Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate...

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

GHSA-xhpv-hc6g-r9c6 CVE-2026-33940 HIGH published 4 months ago • updated 4 days ago

## Summary A crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to ...

Prototype Pollution in handlebars

GHSA-g9r4-xpmj-mj65 HIGH published almost 6 years ago • updated 35 minutes ago

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object pr...

Denial of Service in handlebars

GHSA-f52g-6jhx-586p MODERATE published almost 6 years ago • updated about 2 months ago

Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing spe...

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

GHSA-xjpj-3mr7-gcpf CVE-2026-33941 HIGH published 4 months ago • updated about 1 month ago

## Summary The Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and...

View all 18 advisories

Recent PRs

RSS Feed

chore(deps): bump handlebars from 4.7.7 to 4.7.9

vtexdocs/devportal #1353

4.7.7 → 4.7.9 Patch PR

Open 3 days ago 1 comment

Bump handlebars from 4.7.7 to 4.7.9 in /src/Exceptionless.Web/ClientApp.angular

exceptionless/Exceptionless #2411

4.7.7 → 4.7.9 Patch PR

Open 4 days ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 9 updates

aggnhutquachcdc-roam/web3-react #1

4.7.7 → 4.7.9 Patch PR

Open 10 days ago 2 comments

chore(deps): bump the root-devtools group across 1 directory with 74 updates

songyinggoh/renovation-agent-monorepo #130

4.7.8 → 4.7.9 Patch PR

Open 18 days ago 3 comments

Bump the npm_and_yarn group across 1 directory with 8 updates

felipetruman/ambari #2

4.0.6 → 4.7.9 Minor PR

Closed 23 days ago 1 comment

chore(deps): bump the version-updates-group group with 18 updates

yosuke-291/dependabot-grouped-security-poc #7

4.0.10 → 4.7.9 Minor PR

Closed about 1 month ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 19 updates

Dct555/aa-sdk #9

4.7.8 → 4.7.9 Patch PR

Open about 1 month ago 2 comments

chore(deps): bump the npm_and_yarn group across 7 directories with 13 updates

lannathompson65-arch/toolkit #3

4.7.8 → 4.7.9 Patch PR

Open about 1 month ago 1 comment

chore(deps): bump the npm_and_yarn group across 5 directories with 17 updates

meatflavourdev/docusaurus #5

4.7.7 → 4.7.9 Patch PR

Open about 1 month ago 2 comments

Bump the npm_and_yarn group across 1 directory with 11 updates

OneFineStarstuff/livecodes #9

4.7.7 → 4.7.9 Patch PR

Open about 1 month ago 10 comments

Bump the npm_and_yarn group across 1 directory with 13 updates

OneFineStarstuff/livecodes #5

4.7.7 → 4.7.9 Patch PR

Open about 2 months ago 7 comments

chore(deps): bump handlebars from 4.7.8 to 4.7.9 in /secret-share-client

JerrettDavis/secret-share #3

4.7.8 → 4.7.9 Patch PR

Closed about 2 months ago 1 comment

chore(deps): Bump the npm_and_yarn group across 3 directories with 11 updates

lisaross/n8n #2

4.7.8 → 4.7.9 Patch PR

Open about 2 months ago 1 comment

chore(deps): bump the root-devtools group across 1 directory with 74 updates

songyinggoh/renovation-agent-monorepo #123

4.7.8 → 4.7.9 Patch PR

Open about 2 months ago 3 comments

Bump the npm_and_yarn group across 1 directory with 18 updates

AvansHogeschoolBreda/openmrsmodule #5

4.0.10 → 4.7.9 Minor PR

Closed about 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 2 directories with 20 updates

karbon0x/openworkflow #2

4.7.8 → 4.7.9 Patch PR

Closed about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 4 updates

selfagency/findagrave-client #3

4.7.8 → 4.7.9 Patch PR

Open about 2 months ago 3 comments

Bump the npm_and_yarn group across 1 directory with 16 updates

OneFineStarstuff/livecodes #4

4.7.7 → 4.7.9 Patch PR

Open about 2 months ago 7 comments

Bump handlebars from 4.5.3 to 4.7.9

RAlanWright/Tour-of-Heroes #40

4.5.3 → 4.7.9 Minor PR

Closed about 2 months ago 6 comments

Bump handlebars from 4.5.3 to 4.7.9

jun-low/vue-cryptopare #7

4.5.3 → 4.7.9 Minor PR

Closed about 2 months ago 2 comments

chore(deps): bump handlebars from 4.7.8 to 4.7.9

hazarvolga/aluplan-support-desk-v02 #8

4.7.8 → 4.7.9 Patch PR

Open about 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 17 updates

OneFineStarstuff/livecodes #3

4.7.7 → 4.7.9 Patch PR

Closed about 2 months ago 10 comments

Bump the npm_and_yarn group across 2 directories with 20 updates

lisaross/gatsby #1

4.0.11 → 4.7.9 Minor PR

Closed about 2 months ago 2 comments

Bump the npm_and_yarn group across 1 directory with 15 updates

lisaross/auth0-react-samples #1

4.0.10 → 4.7.9 Minor PR

Open about 2 months ago 1 comment

⬆️ Bump handlebars from 4.4.2 to 4.7.9 in /bff

jeziellopes/bff-graphql-nestjs #10

4.4.2 → 4.7.9 Minor PR

Closed about 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 3 directories with 24 updates

tabrezahmed51/genkit #1

4.7.8 → 4.7.9 Patch PR

Closed about 2 months ago 3 comments

Bump the npm_and_yarn group across 1 directory with 16 updates

goodgollyholly/proofofexistence #1

4.0.5 → 4.7.9 Minor PR

Open about 2 months ago 2 comments

Bump the npm_and_yarn group across 5 directories with 23 updates

suitenumerique/meet #1402

4.7.8 → 4.7.9 Patch PR

Closed about 2 months ago 2 comments

fix(deps): bump the npm_and_yarn group across 1 directory with 27 updates

kapitanov/goscope.net #657

4.7.8 → 4.7.9 Patch PR

Closed about 2 months ago 2 comments

chore(deps): bump the minor-and-patch group across 1 directory with 28 updates

theboss001/elearning_api #11

4.7.8 → 4.7.9 Patch PR

Open about 2 months ago 1 comment

chore(deps)(deps): bump the production-dependencies group across 1 directory with 69 updates

LLM-Dev-Ops/forge #75

4.7.8 → 4.7.9 Patch PR

Open about 2 months ago 2 comments

Bump the npm_and_yarn group across 1 directory with 15 updates

EmilynnJ/gradio #1

4.7.8 → 4.7.9 Patch PR

Open about 2 months ago 4 comments

Bump handlebars from 4.4.2 to 4.7.9 in /wp-content/themes/twentytwenty

IGE-123012/BattleShip2 #35

4.4.2 → 4.7.9 Minor PR

Open 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates

pathharper/organic-typing #84

4.7.8 → 4.7.9 Patch PR

Open 2 months ago 1 comment

Bump handlebars from 4.7.7 to 4.7.9

Automattic/gridicons #329

4.7.7 → 4.7.9 Patch PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 15 updates

JulianiusM/Surveyor #74

4.7.8 → 4.7.9 Patch PR

Open 2 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 23 updates

suitenumerique/meet #1371

4.7.8 → 4.7.9 Patch PR

Open 2 months ago 1 comment

Bump handlebars from 4.0.12 to 4.7.9

Automattic/gutenberg-wpcom-e2e-tests #13

4.0.12 → 4.7.9 Minor PR

Closed 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 21 updates

EmilynnJ/twilio-video-app-react #1

4.7.8 → 4.7.9 Patch PR

Open 2 months ago 4 comments

Chore(deps): Bump the npm_and_yarn group across 1 directory with 11 updates

EmilynnJ/core #1

4.7.8 → 4.7.9 Patch PR

Open 2 months ago 4 comments

Bump the npm_and_yarn group across 3 directories with 14 updates

Cyptopimpinainteazy/remix-project #1

4.7.7 → 4.7.9 Patch PR

Open 2 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 17 updates

Dct555/graphiql #5

4.7.6 → 4.7.9 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 9 updates

alexcolls/p2p-wallet-web #31

4.7.7 → 4.7.9 Patch PR

Closed 2 months ago 1 comment

chore(deps): Bump the npm_and_yarn group across 1 directory with 21 updates

HiromiShikata/aws-cdk #2

4.7.8 → 4.7.9 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 11 directories with 20 updates

gemone/continue #12

4.7.8 → 4.7.9 Patch PR

Closed 2 months ago 1 comment

build(deps): bump the npm_and_yarn group across 7 directories with 10 updates

gionabbe/angular #10

4.0.10 → 4.7.9 Minor PR

Closed 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 23 directories with 19 updates

Reality2byte/core #611

4.7.8 → 4.7.9 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 3 directories with 20 updates

theinsightcentre/generative-ai-google #9

4.7.8 → 4.7.9 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 18 updates

harpertoken/autofix #49

4.7.8 → 4.7.9 Patch PR

Closed 2 months ago 3 comments

Bump the npm_and_yarn group across 16 directories with 19 updates

Future-whitehat7/react #10

4.0.11 → 4.7.9 Minor PR

Closed 2 months ago 1 comment

Package Details

Name:	`handlebars`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/handlebars`
JSON API:	View JSON

Security Advisories

18

Active advisories

CRITICAL 3

HIGH 10

MODERATE 4

LOW 1

View All npm Advisories

Package Information

Description:

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Repository:	https://github.com/handlebars-lang/handlebars.js
Homepage:	https://www.handlebarsjs.com/
Latest Release:	`4.7.8` almost 3 years ago
Dependent Repos:	1,258,975
Dependent Packages:	15,556
Downloads:	80,916,646
Ranking:	Top 0.0276% by dependent repos Top 0.0274% by downloads Top 0.0065% by dependent pkgs

PR Status

Open 1,177 (48.4%)

Merged 34 (1.4%)

Closed 1,178 (48.4%)

PR Types

Major 13 (0.5%)

Minor 624 (25.6%)

Patch 1,745 (71.7%)

Removal 3 (0.1%)