CVE-2026-33916
published 2026-03-27CVE-2026-33916: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime…
PriorityP423medium4.7CVSS 3.1
AVNACHPRNUIRSCCLILAN
EPSS
0.23%
14.0th percentile
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-handlebars | < node-handlebars 3:4.7.9-1 (forky) | node-handlebars 3:4.7.9-1 (forky) |
| handlebars-lang | handlebars.js | — | — |
| handlebarsjs | handlebars | >= 4.0.0 < 4.7.9 | 4.7.9 |
| handlebarsjs | handlebars | >= 4.0.0 < 4.7.9 | 4.7.9 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Handlebars up to 4.7.7 cross site scripting (Nessus ID 304162 / WID-SEC-2026-1407)
vuldb·2026-06-20·CVSS 4.7
CVE-2026-33916 [MEDIUM] Handlebars up to 4.7.7 cross site scripting (Nessus ID 304162 / WID-SEC-2026-1407)
A vulnerability was found in Handlebars up to 4.7.7. It has been classified as problematic. Affected by this issue is some unknown functionality. This manipulation causes cross site scripting.
This vulnerability is tracked as CVE-2026-33916. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is recommended.
OSV
CVE-2026-33916: Handlebars provides the power necessary to let users build semantic templates
osv·2026-03-27·CVSS 4.7
CVE-2026-33916 [MEDIUM] CVE-2026-33916: Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does
OSV
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
osv·2026-03-26·CVSS 9.8
CVE-2026-33916 [CRITICAL] Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
## Summary
`resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered **without HTML escaping**, resulting in reflected or stored XSS.
## Description
The root cause is in `lib/handlebars/runtime.js` inside `resolvePartial()` and `invokePartial()`:
```javascript
// Vulnerable: plain bracket access traverses Object.prototype
partial = options.partials[options.name];
```
`hasOwnProperty` is never checked, so if `Object
GHSA
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
ghsa·2026-03-26·CVSS 9.8
CVE-2026-33916 [CRITICAL] CWE-1321 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
## Summary
`resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered **without HTML escaping**, resulting in reflected or stored XSS.
## Description
The root cause is in `lib/handlebars/runtime.js` inside `resolvePartial()` and `invokePartial()`:
```javascript
// Vulnerable: plain bracket access traverses Object.prototype
partial = options.partials[options.name];
```
`hasOwnProperty` is never checked, so if `Object
Red Hat
handlebars.js: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution
vendor_redhat·2026-03-27·CVSS 4.7
CVE-2026-33916 [MEDIUM] CWE-915 handlebars.js: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution
handlebars.js: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may b
Debian
CVE-2026-33916: node-handlebars - Handlebars provides the power necessary to let users build semantic templates. I...
vendor_debian·2026·CVSS 4.7
CVE-2026-33916 [MEDIUM] CVE-2026-33916: node-handlebars - Handlebars provides the power necessary to let users build semantic templates. I...
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33916 openbao: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [fedora-all]
bugzilla·2026-03-28·CVSS 4.7
CVE-2026-33916 [MEDIUM] CVE-2026-33916 openbao: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [fedora-all]
CVE-2026-33916 openbao: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
OpenBao does not have any javascript in the server, so this vulnerability is not applicable.
Bugzilla
CVE-2026-33916 nextcloud: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [epel-all]
bugzilla·2026-03-28·CVSS 4.7
CVE-2026-33916 [MEDIUM] CVE-2026-33916 nextcloud: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [epel-all]
CVE-2026-33916 nextcloud: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-ca43aa006f (nextcloud-33.0.1-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-ca43aa006f
---
FEDORA-EPEL-2026-35986c0192 (nextcloud-33.0.1-1.el10_1) has been submitted as an update to Fedora EPEL 10.1.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-35986c0192
---
FEDORA-2026-0dc1d7ff6d has been pushed to the Fedora 43 testing repository.
Soon you'll be a
Bugzilla
CVE-2026-33916 nextcloud: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [fedora-all]
bugzilla·2026-03-28·CVSS 4.7
CVE-2026-33916 [MEDIUM] CVE-2026-33916 nextcloud: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [fedora-all]
CVE-2026-33916 nextcloud: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-cb5661d883 (nextcloud-33.0.3-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-cb5661d883
---
FEDORA-2026-6599e30e04 (nextcloud-33.0.3-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-6599e30e04
---
FEDORA-EPEL-2026-f7ea7872a6 (nextcloud-33.0.3-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
Bugzilla
CVE-2026-33916 openbao: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [epel-all]
bugzilla·2026-03-28·CVSS 4.7
CVE-2026-33916 [MEDIUM] CVE-2026-33916 openbao: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [epel-all]
CVE-2026-33916 openbao: Handlebars: Cross-Site Scripting (XSS) via prototype pollution in partial resolution [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
OpenBao does not have any javascript in the server, so this vulnerability is not applicable.
Wiz
CVE-2026-33916 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.8
CVE-2026-33916 [LOW] CVE-2026-33916 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33916 :
Grafana vulnerability analysis and mitigation
resolvePartial()
options.partials
Object.prototype
Object.freeze(Object.prototype)
handlebars/runtime
Source : NVD
## 4.7
Score
Published March 27, 2026
Severity MEDIUM
CNA Score 4.7
Affected Technologies
Grafana
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
grafana-loki
grafana-postgres
Sources
NVD
Chainguard Has Fix Added at: Mar 29, 2026
Debian 11, 12, 13 Severity MEDIUM No Fix Added at: Mar 29, 2026
Debian 14 Severity MEDIUM Has Fix Added at: Mar 29, 2026
Echo Severity MEDIUM No Fix Added at: Mar 29, 2026
npm Severity ME
2026-03-27
Published