CVE-2026-33937
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows remote code execution (RCE) by injecting malicious JavaScript into generated code. The issue stems from unsanitized `value` fields in `NumberLiteral` AST nodes during template compilation. An attacker can supply a crafted AST object to `Handlebars.compile()`, leading to arbitrary code execution on the server.
Risk Assessment
The risk is critical – a remote attacker could take over the server, exfiltrate data, or deploy malware. This affects applications that dynamically compile templates from untrusted sources using Handlebars.
Recommendation
Immediately upgrade Handlebars to version 4.7.9 or later. As a workaround, always validate that the argument to `Handlebars.compile()` is a `string`, not an object or JSON-deserialized value. Consider using the runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled.
Original NVD description (English source)
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable.