VDB
CVE-2026-106446
CVE-2026-106446
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
EPSS 0.79% · 56.0th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.79%
56.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | gitlab-rails-ce-fips-19.5 | * |
| wolfi | ts-patch | 0 |
| wolfi | nextcloud-server-33 | 0 |
| chainguard | wazuh-dashboard-fips | 0 |
| chainguard | opensearch-dashboards-2 | 0 |
| wolfi | tileserver-gl | 0 |
| chainguard | langfuse-4 | 0 |
| chainguard | verdaccio | 0 |
| chainguard | wazuh-dashboard | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | * |
| chainguard | opensearch-dashboards-3 | 0 |
| chainguard | librechat | 0 |
| chainguard | renovate | 0 |
| chainguard | kibana-8.19 | 0 |
| chainguard | kibana-9.5 | 0 |
| chainguard | nextcloud-server-33 | 0 |
| handlebars-lang | handlebars.js | 4.0.0 |
| chainguard | ts-patch | 0 |
| wolfi | lerna | 0 |
| wolfi | renovate | 0 |
…and 15 more
Timeline
- Oct 6, 2026 Coalition ESS Score
- Oct 6, 2026 CVE Published
- Oct 7, 2026 EPSS Score
- Oct 8, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-106446 advisory
- https://github.com/advisories/GHSA-8r5x-fm3f-whwj advisory
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj url
- https://github.com/handlebars-lang/handlebars.js/pull/2185 patch
- https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2 patch
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10 url