handlebars

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Latest 4.7.10

NPM

70%

Total Score

caution

No commits in three months and all 14 workflow actions are unpinned, despite a mature, actively published project.

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, a meaningful maintenance warning despite recent registry releases and repository activity elsewhere.

Workflow audit

All 14 analyzed action references are unpinned, reducing build reproducibility. The audit also reports a high-severity but low-confidence cache-poisoning pattern and an informational trusted-publishing finding; no untrusted checkouts or script injection were found.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-869467 New handlebars is vulnerable to Cross-Site Scripting (XSS) in versions 4.0.0 - 4.7.9.	4.0.0 - 4.7.9	Medium
AIKIDO-2026-258160 New handlebars is vulnerable to Remote Code Execution (RCE) in versions 4.0.0 - 4.7.9.	4.0.0 - 4.7.9	Critical
AIKIDO-2026-970464 New handlebars is vulnerable to Code Injection in versions 3.0.0 - 4.7.9.	3.0.0 - 4.7.9	Critical
CVE-2026-33938 handlebars is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 4.0.0 - 4.7.8.	4.0.0 - 4.7.8	High
CVE-2026-33937 handlebars is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 4.0.0 - 4.7.8.	4.0.0 - 4.7.8	Critical