CVE-2026-106446

Two flaws in Handlebars.js, scored 9.8 and 9.2, with public proof-of-concept code. The library is downloaded about 172 million times a month. The first lets anything that can pass an object instead of a template string place expressions into the generated code; the second walks a deny list that runs one step too late.

1 article — 2026-10-07

Authoritative record

Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.

Our coverage

Handlebars checked the parts of the template it expected to see, and compiled everything else into JavaScript

2026-10-07Security

../cve — every identifier we have covered