CVE-2026-33938
Handlebars provides the power necessary to let users build semantic templates.
Published Mar 27, 2026 · updated Sep 4, 2026 · handlebarsjs handlebars
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites with a crafted Handlebars AST, a subsequent invocation of compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build ( ). The method is absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as ) in contexts where templates or context data can be influenced by untrusted input.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites with a crafted Handlebars AST, a subsequent invocation of compiles and executes that AST, enabling arbitrary
Sep 4, 2026 · NIST NVD
Updated
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites with a crafted Handlebars AST, a subsequent invocation of compiles and executes that AST, enabling arbitrary
Affected
- cpe handlebarsjs/handlebarsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33938
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33938
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objec
nvd.nist.gov