Handlebars checked the parts of the template it expected to see, and compiled everything else into JavaScript
2026-10-07Security
Two flaws in Handlebars.js, scored 9.8 and 9.2, with public proof-of-concept code. The library is downloaded about 172 million times a month. The first lets anything that can pass an object instead of a template string place expressions into the generated code; the second walks a deny list that runs one step too late.