Package
gitlab-rails-ce-assets-fips-19.4
Component
handlebars
Latest update
4.7
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
False positive. The flagged file is /srv/gitlab/public/assets/webpack/gitlab-web-ide-vscode-workbench-*/vscode/extensions/handlebars/package.json, the manifest of the VS Code built-in "handlebars" language extension bundled with the GitLab Web IDE, not the handlebars npm library. That extension contains only a TextMate grammar, a language configuration and the manifest (no JavaScript, no "main"/"browser" entry, no dependencies); upstream it is microsoft/vscode extensions/handlebars, versioned 10.0.0. The scanner matches it as npm "handlebars" only by its package name. The handlebars template-compiler code affected by CVE-2026-106444/106445/106446 is not present in the package. (The build rewrites this manifest's version field to 4.7.9 to silence earlier scanner hits, which is why it is reported as handlebars 4.7.9.)
Status