Repository navigation
handlebars-2.0.0.min.js: 1 vulnerabilities (highest severity is: 4.7) #10
Description
Vulnerable Library - handlebars-2.0.0.min.js
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/2.0.0/handlebars.min.js
Path to vulnerable library: /WebContent/swagger/lib/handlebars-2.0.0.js
Found in HEAD commit: 419ec1ba96ce40f40a6f920dad16456c2b3477b5
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (handlebars version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2026-106444 |  Medium |
4.7 | handlebars-2.0.0.min.js | Direct | N/A | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-106444
Vulnerable Library - handlebars-2.0.0.min.js
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/2.0.0/handlebars.min.js
Path to vulnerable library: /WebContent/swagger/lib/handlebars-2.0.0.js
Dependency Hierarchy:
- ❌ handlebars-2.0.0.min.js (Vulnerable Library)
Found in HEAD commit: 419ec1ba96ce40f40a6f920dad16456c2b3477b5
Found in base branch: AltoroJ-3.2
Vulnerability Details
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
Publish Date: 2026-10-06
URL: CVE-2026-106444
CVSS 3 Score Details (4.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Activity
[-]handlebars-2.0.0.min.js: 8 vulnerabilities (highest severity is: 9.8)[/-][+]handlebars-2.0.0.min.js: 9 vulnerabilities (highest severity is: 9.8)[/+][-]handlebars-2.0.0.min.js: 9 vulnerabilities (highest severity is: 9.8)[/-][+]handlebars-2.0.0.min.js: 2 vulnerabilities (highest severity is: 5.6)[/+][-]handlebars-2.0.0.min.js: 2 vulnerabilities (highest severity is: 5.6)[/-][+]handlebars-2.0.0.min.js: 1 vulnerabilities (highest severity is: 4.7)[/+]