CVE-2026-33938
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows arbitrary JavaScript execution on the server. The `@partial-block` special variable is stored in the template data context and can be overwritten by helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent `{{> @partial-block}}` invocation compiles and executes that AST, enabling code execution.
Risk Assessment
The risk to the organization is critical – an attacker can take over the server, steal data, or deploy malware. The vulnerability can be exploited remotely without authentication if the application processes untrusted templates or context data.
Recommendation
Immediately update Handlebars to version 4.7.9 or later. If updating is not possible, apply workarounds: use the runtime-only build (`require('handlebars/runtime')`), audit helpers for writing arbitrary values to context, and avoid registering helpers from third-party packages in environments with untrusted input.
Other vulnerabilities in Handlebars
See all- CVE-2026-33937Critical
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows remote code execution (RCE) by injecting malicious JavaScript into generated code. The issue stems from unsanitized `value` fields in `NumberLiteral` AST nodes during template compilation. An attacker can supply a crafted AST object to `Handlebars.compile()`, leading to arbitrary code execution on the server.
- CVE-2026-33941High
A vulnerability in the Handlebars CLI precompiler (versions 4.0.0 through 4.7.8) allows arbitrary JavaScript injection via unsanitized template filenames and CLI arguments. An attacker can execute arbitrary code in Node.js or browser environments when the generated bundle is loaded.
- CVE-2026-33940High
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows an attacker to achieve remote code execution on the server by injecting a crafted object into the template context. The object bypasses security checks in `resolvePartial()` and causes `env.compile()` to compile malicious JavaScript. The issue is fixed in version 4.7.9.
- CVE-2026-33939High
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 causes a Node.js process crash when processing a template with an unregistered decorator. A TypeError occurs when the runtime attempts to invoke an undefined value as a function.
Original NVD description (English source)
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in contexts where templates or context data can be influenced by untrusted input.