handlebars

Clear licensing, bundled types, and an established organization make integration straightforward. Pin this release while monitoring the project’s reduced development activity.

Latest 4.7.10

NPM

70%

Total Score

Maintainer Stability

Maturity

100

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, a meaningful maintenance warning despite recent registry releases and repository activity elsewhere.

Workflow audit

All 14 analyzed action references are unpinned, reducing build reproducibility. The audit also reports a high-severity but low-confidence cache-poisoning pattern and an informational trusted-publishing finding; no untrusted checkouts or script injection were found.

Vulnerabilities

Title	Versions	Severity
CVE-2026-33938 handlebars is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 4.0.0 - 4.7.8.	4.0.0 - 4.7.8	High
CVE-2026-33937 handlebars is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 4.0.0 - 4.7.8.	4.0.0 - 4.7.8	Critical
CVE-2026-33941 handlebars is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 4.0.0 - 4.7.8.	4.0.0 - 4.7.8	High
CVE-2026-33940 handlebars is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 4.0.0 - 4.7.8.	4.0.0 - 4.7.8	High
CVE-2026-33939 handlebars is vulnerable to Improper Check for Unusual or Exceptional Conditions in versions 4.0.0 - 4.7.8.	4.0.0 - 4.7.8	High