CVE-2026-33940
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows an attacker to achieve remote code execution on the server by injecting a crafted object into the template context. The object bypasses security checks in `resolvePartial()` and causes `env.compile()` to compile malicious JavaScript. The issue is fixed in version 4.7.9.
Risk Assessment
An attacker who controls a value used in dynamic partial lookups can execute arbitrary commands on the server, leading to full application compromise and potential data breach.
Recommendation
Upgrade Handlebars to version 4.7.9 or later immediately. If upgrading is not possible, apply one of the workarounds: use the runtime-only build (`require('handlebars/runtime')`), sanitize context data before rendering, or avoid dynamic partial lookups with user-controlled data.
Other vulnerabilities in Handlebars
See all- CVE-2015-8861Medium
The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
- CVE-2026-106446Critical
Handlebars from 4.0.0 to 4.7.10 accepts pre-parsed AST objects in compile() and precompile() while validating only selected values. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values, leading to code execution on the server. Applications that pass only template strings are not affected. Fixed in 4.7.10.
- CVE-2026-106445Critical
Handlebars versions from 3.0.0 to 4.7.10 are vulnerable because lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list. An attacker who can render a controlled template with allowProtoMethodsByDefault enabled can access the Function constructor via a bypass, allowing attacker-controlled JavaScript to execute with the server application's privileges.
- CVE-2026-33937Critical
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows remote code execution (RCE) by injecting malicious JavaScript into generated code. The issue stems from unsanitized `value` fields in `NumberLiteral` AST nodes during template compilation. An attacker can supply a crafted AST object to `Handlebars.compile()`, leading to arbitrary code execution on the server.
- CVE-2021-23383Medium
The package handlebars before 4.7.7 is vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
- CVE-2021-23369Medium
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
- CVE-2019-19919Critical
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
- CVE-2026-106444Medium
In Handlebars from 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source in an inline script element, a closing script delimiter can end the element and cause following markup to be parsed and executed.
- CVE-2026-33941High
A vulnerability in the Handlebars CLI precompiler (versions 4.0.0 through 4.7.8) allows arbitrary JavaScript injection via unsanitized template filenames and CLI arguments. An attacker can execute arbitrary code in Node.js or browser environments when the generated bundle is loaded.
- CVE-2026-33939High
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 causes a Node.js process crash when processing a template with an unregistered decorator. A TypeError occurs when the runtime attempts to invoke an undefined value as a function.
Original NVD description (English source)
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). Without `compile()`, the fallback compilation path in `invokePartial` is unreachable. Second, sanitize context data before rendering: Ensure no value in the context is a non-primitive object that could be passed to a dynamic partial. Third, avoid dynamic partial lookups (`{{> (lookup ...)}}`) when context data is user-controlled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS