CVE-2026-33938 PUBLISHED

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Assigner: GitHub_M
Reserved: 24.03.2026 Published: 27.03.2026 Updated: 27.03.2026

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites @partial-block with a crafted Handlebars AST, a subsequent invocation of {{> @partial-block}} compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (require('handlebars/runtime')). The compile() method is absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as handlebars-helpers) in contexts where templates or context data can be influenced by untrusted input.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1

Product Status

Vendor handlebars-lang
Product handlebars.js
Versions
  • Version >= 4.0.0, < 4.7.9 is affected

References

Problem Types

  • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE
  • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') CWE