Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Handlebars: JavaScript Injection via Own Property Check Bypass

Fix availableCritical · CVSS 9.2EPSS 0.41%

Published Oct 8, 2026 · updated Oct 12, 2026

What to do

  1. Upgrade to a fixed version: handlebars 4.7.10.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmhandlebars

Vulnerable versions
>= 3.0.0, <= 4.7.9
Fixed in
4.7.10

Check your project: npm ls handlebars --all

Is handlebars@4.7.10 safe to install? See the upgrade verdict →

Sources

CWE-184 Incomplete List of Disallowed Inputs · CWE-1289 Improper Validation of Unsafe Equivalence in Input

← All critical vulnerabilities