Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Fix availableCritical · CVSS 9.8EPSS 0.64%

Published Oct 8, 2026 · updated Oct 8, 2026

What to do

  1. Upgrade to a fixed version: handlebars 4.7.10.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmhandlebars

Vulnerable versions
>= 4.0.0, <= 4.7.9
Fixed in
4.7.10

Check your project: npm ls handlebars --all

Is handlebars@4.7.10 safe to install? See the upgrade verdict →

Sources

CWE-94 Improper Control of Generation of Code ('Code Injection') · CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

← All critical vulnerabilities