{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d9a3dd3f-fae1-5639-b540-b6e2662695dc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "handlebars", "purl": "pkg:npm/handlebars@1.3.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/handlebars@1.3.0-tuxcare.5", "version": "1.3.0-tuxcare.5", "pedigree": { "ancestors": [ { "name": "handlebars", "purl": "pkg:npm/handlebars@1.3.0", "type": "library", "version": "1.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2015-8861", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d09765ba-2819-575d-a59b-bb718fce2812", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-8861 is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "CVE-2019-19919", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c5d488b6-1d10-5e86-bb7a-a8a6f53acdb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-19919 is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "CVE-2019-20920", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:5f15a488-ab3e-57fe-bca3-0bcab36ac1e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-20920 is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "CVE-2021-23369", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:105e8c1e-c576-54b4-a045-08f922413063", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23369 is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "CVE-2021-23383", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:1c0186a4-0320-590f-bbb2-75d995cd97ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-23383 is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "CVE-2026-33937", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:08a09aef-bb2d-5aa6-b06d-a7d547f5aac7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33937 affects version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "CVE-2026-33938", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:18fdbd6c-83fa-5a65-a96b-6e5acb54e262", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33938 does not affect version 1.3.0-tuxcare.5 of handlebars. not_affected \u2014 CVE-2026-33938 describes a vulnerability where the @partial-block special variable can be overwritten with a crafted Handlebars AST via helpers, leading to arbitrary JavaScript execution when {{> @partial-block}} is invoked. The target repository (Handlebars 1.3.0) does not have the @partial-block feature at all, as this was introduced in later versions. The specific attack chain described in t...", "justification": "code_not_present" } }, { "id": "CVE-2026-33939", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7ffc7556-0fee-5679-a8cd-085cd4dc99a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33939 does not affect version 1.3.0-tuxcare.5 of handlebars. not_affected \u2014 Handlebars version 1.3.0 is not affected by CVE-2026-33939. The vulnerability concerns decorator invocations ({{*name}} syntax), but decorators were not introduced until Handlebars 3.x+ (2015-2016), years after version 1.3.0's release in January 2014. The target codebase has no decorator support infrastructure: no DecoratorNode in the AST, no decorator visitor methods in the compiler, no decora...", "justification": "code_not_present" } }, { "id": "CVE-2026-33940", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d8324845-c35e-5dd0-9cf9-18e5bb6e7847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33940 does not affect version 1.3.0-tuxcare.5 of handlebars. not_affected \u2014 Handlebars 1.3.0 is not affected by CVE-2026-33940. The vulnerability requires dynamic partial support ({{> (expression)}}) which was added in v3.0.0+. Version 1.3.0 additionally employs constructor validation that rejects plain JavaScript objects from being treated as AST, blocking the typical attack vector where user-controlled JSON data reaches the compiler.", "justification": "code_not_present" } }, { "id": "CVE-2026-33941", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2c9c0574-a716-51e5-ace6-e08e5c9b23a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33941 affects version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "GHSA-2cf5-4w76-r9qv", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:79ec255e-9fb1-5560-a892-723b333d0333", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "GHSA-442j-39wm-28r2", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:47141924-8290-5159-961d-132d81f4afdc", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-442j-39wm-28r2 does not affect version 1.3.0-tuxcare.5 of handlebars. not_affected \u2014 Handlebars version 1.3.0 is not affected by GHSA-442j-39wm-28r2. The vulnerability exists in the container.lookup() function when compat mode is enabled, but this function and compat mode were introduced 7.5 months after v1.3.0 was released. Version 1.3.0 uses a fundamentally different architecture for depth-based template context handling.", "justification": "code_not_present" } }, { "id": "GHSA-6r5x-hmgg-7h53", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:df3f4e8b-0ae0-520d-8b30-b81a8d7dcf43", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6r5x-hmgg-7h53 is a false positive for handlebars 1.3.0-tuxcare.5." } }, { "id": "GHSA-7rx3-28cr-v5wh", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:649d00a4-8993-531e-ae36-2250d3914178", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7rx3-28cr-v5wh affects version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "GHSA-fmr4-7g9q-7hc7", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ffed34d8-d5ed-524e-bebe-2dcd55a05167", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fmr4-7g9q-7hc7 is a false positive for handlebars 1.3.0-tuxcare.5." } }, { "id": "GHSA-g9r4-xpmj-mj65", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:024abeaa-1b5d-58e5-8f43-a59358fb0f51", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "GHSA-q2c6-c6pm-g3gh", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:7239db8b-ad69-5a28-bf74-bd8dd9f19231", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh is fixed in version 1.3.0-tuxcare.5 of handlebars." } }, { "id": "GHSA-q42p-pg8m-cqh6", "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ], "bom-ref": "urn:uuid:12bbf1fb-62a2-5224-8cdb-6326e4518a37", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 1.3.0-tuxcare.5 of handlebars." } } ], "dependencies": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.5" } ] }