https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33941.htmlhttps://patchthecve.com/cve/CVE-2026-33941.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.2: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript ihttps://patchthecve.com/cve/CVE-2026-33940.htmlhttps://patchthecve.com/cve/CVE-2026-33940.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.1: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treathttps://patchthecve.com/cve/CVE-2026-33939.htmlhttps://patchthecve.com/cve/CVE-2026-33939.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.5: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `unhttps://patchthecve.com/cve/CVE-2026-33938.htmlhttps://patchthecve.com/cve/CVE-2026-33938.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.1: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper ovhttps://patchthecve.com/cve/CVE-2026-33937.htmlhttps://patchthecve.com/cve/CVE-2026-33937.htmlMon, 26 Oct 2026 22:10:00 +0000CRITICAL 9.8: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript whttps://patchthecve.com/cve/CVE-2026-33916.htmlhttps://patchthecve.com/cve/CVE-2026-33916.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 4.7: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.proto