DocumentationExperience Cloud KCS

Verify Handlebars.js 4.7.7 removal or upgrade in AEM 6.5 after security patch

Last update: October 21, 2026

Adobe Experience Manager (AEM) 6.5 On-Premise security scans may continue to detect Handlebars.js 4.7.7 after applying the security patch, including detections in non-runtime or backup locations. To resolve the issue, verify the Handlebars.js version in the runtime bundles and client library locations and confirm that runtime implementations use 4.7.9 instead of 4.7.7.

Description description

Environment

Adobe Experience Manager (AEM) 6.5 On-Premise (all service packs)

Issue/Symptoms

After applying the security patch for the Handlebars.js vulnerability, you want to confirm that Handlebars.js 4.7.7 is no longer present or used in the runtime environment, including the runtime bundle and client library locations.

Root cause

The security patch for AEM 6.5 upgrades all runtime Handlebars.js implementations to 4.7.9 to remediate a known vulnerability. Scanner tools may still report older versions in non-runtime or backup locations, but these don’t affect the running system.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Confirm that the security patch for Handlebars.js has been applied to the AEM 6.5 On-Premise environment.

    1. Check the runtime bundles:
    2. Go to the AEM installation directory and locate the runtime bundles, for example, in /crx-quickstart/launchpad/felix/.
    3. Identify the Handlebars runtime bundle, commonly named com.github.jknack.handlebars or similar.
    4. Inspect the embedded Handlebars.js version in this bundle and confirm that it’s 4.7.9.
    5. Ensure that 4.7.7 is no longer present or referenced in any active runtime bundle.

  2. Check the following client library locations for the Handlebars.js version:

    • /libs/clientlibs/social/thirdparty/handlebars/source/handlebars.js
    • /libs/granite/ui/components/foundation/form/formbuilder/clientlibs/js/handlebars.js
    • /libs/clientlibs/granite/coralui2/optional/clientlibs/source/handlebars-v4.7.7.min.js
    • /libs/dam/gui/coral/components/admin/schemaforms/formbuilder/handlebars/clientlibs/js/handlebars.js
    • /libs/tsdk/handlebars/js/handlebars.js
    • /libs/granite/contexthub/dependencies/handlebars/handlebars-v4.7.3.min.js

  3. Confirm that all runtime client libraries now reference Handlebars 4.7.9, not 4.7.7.

  4. Ignore scanner detections in installation media, backup directories, or non-runtime files, because these don’t affect the running environment.

  5. After completing these checks, confirm that the vulnerable Handlebars.js 4.7.7 library is no longer present or used at runtime.

recommendation-more-help
experience-cloud-kcs-help-kbarticles