{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ad318307-6617-514e-8843-c9acc4b66463", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:npm/handlebars@1.3.0-tuxcare.1", "type": "library", "name": "handlebars", "version": "1.3.0-tuxcare.1", "purl": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:8847765f-b8cb-5f54-938c-864197612f76", "id": "CVE-2015-8861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-8861 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:71d760b6-ab20-5290-917a-8a38ae97df06", "id": "CVE-2017-16138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2017-16138 is fixed in version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:09352584-a507-5c36-b59e-e7e22cbe5a73", "id": "CVE-2019-19919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-19919 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d3b8af18-cc95-5f02-85be-a3b2f22372b6", "id": "CVE-2019-20920", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-20920 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9b75ad89-59b0-52cf-85d5-cd3af718a077", "id": "CVE-2021-23369", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-23369 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8619c156-04b4-51fd-8e84-8902e12242f1", "id": "CVE-2021-23383", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-23383 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dbb8f5f5-0a4e-5ee9-877c-d1f7398e03d2", "id": "CVE-2026-33937", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33937 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:85267ad0-c125-5bb3-8d47-62c2b95113e8", "id": "CVE-2026-33938", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33938 does not affect version 1.3.0-tuxcare.1 of handlebars. not_affected \u2014 CVE-2026-33938 describes a vulnerability where the @partial-block special variable can be overwritten with a crafted Handlebars AST via helpers, leading to arbitrary JavaScript execution when {{> @partial-block}} is invoked. The target repository (Handlebars 1.3.0) does not have the @partial-block feature at all, as this was introduced in later versions. The specific attack chain described in t..." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:93303d95-30d7-5966-973a-32fbce6c94ca", "id": "CVE-2026-33939", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33939 does not affect version 1.3.0-tuxcare.1 of handlebars. not_affected \u2014 Handlebars version 1.3.0 is not affected by CVE-2026-33939. The vulnerability concerns decorator invocations ({{*name}} syntax), but decorators were not introduced until Handlebars 3.x+ (2015-2016), years after version 1.3.0's release in January 2014. The target codebase has no decorator support infrastructure: no DecoratorNode in the AST, no decorator visitor methods in the compiler, no decora..." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8698864d-9244-5bfe-be71-a953a7e00476", "id": "CVE-2026-33940", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33940 does not affect version 1.3.0-tuxcare.1 of handlebars. not_affected \u2014 Handlebars 1.3.0 is not affected by CVE-2026-33940. The vulnerability requires dynamic partial support ({{> (expression)}}) which was added in v3.0.0+. Version 1.3.0 additionally employs constructor validation that rejects plain JavaScript objects from being treated as AST, blocking the typical attack vector where user-controlled JSON data reaches the compiler." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:68316ca6-a2c2-5560-9955-66df2203eb28", "id": "CVE-2026-33941", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33941 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8496d865-b1dc-5302-9c6b-5d019e521292", "id": "GHSA-2cf5-4w76-r9qv", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2cf5-4w76-r9qv affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3cf0d676-0546-512c-b756-6308d3f0ac39", "id": "GHSA-442j-39wm-28r2", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-442j-39wm-28r2 does not affect version 1.3.0-tuxcare.1 of handlebars. not_affected \u2014 Handlebars version 1.3.0 is not affected by GHSA-442j-39wm-28r2. The vulnerability exists in the container.lookup() function when compat mode is enabled, but this function and compat mode were introduced 7.5 months after v1.3.0 was released. Version 1.3.0 uses a fundamentally different architecture for depth-based template context handling." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:60a180e0-ee8d-5b62-8538-da712fac824e", "id": "GHSA-6r5x-hmgg-7h53", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6r5x-hmgg-7h53 is a false positive for handlebars 1.3.0-tuxcare.1." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:62e164b2-810b-580a-96c3-9bbed5aa603c", "id": "GHSA-7rx3-28cr-v5wh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7rx3-28cr-v5wh affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ebf57189-716b-54fe-bf7f-f13d17139e63", "id": "GHSA-fmr4-7g9q-7hc7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fmr4-7g9q-7hc7 is a false positive for handlebars 1.3.0-tuxcare.1." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d45331fc-6708-5abf-9667-fef354883c49", "id": "GHSA-g9r4-xpmj-mj65", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-g9r4-xpmj-mj65 affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:58769724-b20b-5bf4-9df3-40d369e4a940", "id": "GHSA-q2c6-c6pm-g3gh", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-q2c6-c6pm-g3gh affects version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f8c5c477-a119-5bb1-93f6-4e53bcccd985", "id": "GHSA-q42p-pg8m-cqh6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-q42p-pg8m-cqh6 is fixed in version 1.3.0-tuxcare.1 of handlebars." }, "affects": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:npm/handlebars@1.3.0-tuxcare.1" } ] }