CVE-2026-33916
Handlebars provides the power necessary to let users build semantic templates.
Published Mar 27, 2026 · updated Jun 17, 2026 · handlebarsjs handlebars
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, in the Handlebars runtime resolves partial names via a plain property lookup on without guarding against prototype-chain traversal. When has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build ( ), which does not compile templates and reduces the attack surface.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, in the Handlebars runtime resolves partial names via a plain property lookup on without guarding against prototype-chain traversal. When has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered
Jun 17, 2026 · NIST NVD
Updated
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, in the Handlebars runtime resolves partial names via a plain property lookup on without guarding against prototype-chain traversal. When has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered
Affected
- cpe handlebarsjs/handlebarsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33916
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33916
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, in the Handlebars runtime resolves partial names via a plain property lookup on without guarding against prototype-chain traversal
nvd.nist.gov