CVE-2026-33938: RCE in Handlebars.js Templates

The vulnerability stems from the mishandling of the @partial-block special variable. Attackers can exploit this by crafting a malicious Handlebars AST (Abstract Syntax Tree) and overwriting the @partial-block variable within the template data context. Subsequently, when {{> @partial-block}} is invoked, the crafted AST is compiled and executed, leading to arbitrary JavaScript execution on the server. This can result in complete system compromise, including data exfiltration, privilege escalation, and denial of service. The impact is particularly severe in applications that dynamically generate templates from untrusted sources, as an attacker could inject malicious code directly into the rendering pipeline.

1. Reserved2026-03-24
2. Published2026-03-27
3. Modified2026-04-01
4. EPSS updated2026-04-04

The primary mitigation is to upgrade to Handlebars.js version 4.7.9 or later, which addresses the vulnerability. If upgrading is not immediately feasible, consider using the runtime-only build (require('handlebars').create().compile('...')) as this prevents the compilation of ASTs. Additionally, carefully validate and sanitize any objects passed to Handlebars helpers to prevent attackers from injecting malicious ASTs. Implement strict input validation for all template data to minimize the attack surface. Consider using a Web Application Firewall (WAF) to detect and block requests containing suspicious Handlebars template code.

Last updated

4.7.9recently