CVE-2026-33940
published 2026-03-27CVE-2026-33940: Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context…
PriorityP354high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.69%
48.0th percentile
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). Without `compile()`, the fallback compilation path in `invokePartial` is unreachable. Second, sanitize context data before rendering: Ensure no value in the context is a non-primitive object that could be passed to a dynamic partial. Third, avoid dynamic partial lookups (`{{> (lookup ...)}}`) when context data is user-controlled.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-handlebars | < node-handlebars 3:4.7.9-1 (forky) | node-handlebars 3:4.7.9-1 (forky) |
| handlebars-lang | handlebars.js | — | — |
| handlebarsjs | handlebars | >= 4.0.0 < 4.7.9 | 4.7.9 |
| handlebarsjs | handlebars | >= 4.0.0 < 4.7.9 | 4.7.9 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context
vendor_redhat·2026-03-27·CVSS 8.1
CVE-2026-33940 [HIGH] CWE-94 handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context
handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available.
Debian
CVE-2026-33940: node-handlebars - Handlebars provides the power necessary to let users build semantic templates. I...
vendor_debian·2026·CVSS 8.1
CVE-2026-33940 [HIGH] CVE-2026-33940: node-handlebars - Handlebars provides the power necessary to let users build semantic templates. I...
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). Without `compil
OSV
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
osv·2026-03-27
CVE-2026-33940 [HIGH] Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
## Summary
A crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup.
## Description
The vulnerable code path spans two functions in `lib/handlebars/runtime.js`:
**`resolvePartial()`:** A crafted object with `
GHSA
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
ghsa·2026-03-27
CVE-2026-33940 [HIGH] CWE-843 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
## Summary
A crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup.
## Description
The vulnerable code path spans two functions in `lib/handlebars/runtime.js`:
**`resolvePartial()`:** A crafted object with `
OSV
CVE-2026-33940: Handlebars provides the power necessary to let users build semantic templates
osv·2026-03-27·CVSS 8.1
CVE-2026-33940 [HIGH] CVE-2026-33940: Handlebars provides the power necessary to let users build semantic templates
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). Without `compil
No detection rules found.
No public exploits indexed.
Wiz
GHSA-442j-39wm-28r2 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
[HIGH] GHSA-442j-39wm-28r2 Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-442j-39wm-28r2 :
Handlebars vulnerability analysis and mitigation
## Summary
lib/handlebars/runtime.js
container.lookup()
container.lookupProperty()
depths[i][name]
lookupProperty
{compat: true}
depthedLookup
lib/handlebars/compiler/javascript-compiler.js
## Description
lib/handlebars/runtime.js
lookup: function (depths, name) {
const len = depths.length;
for (let i = 0; i < len; i++) {
let result = depths[i] && container.lookupProperty(depths[i], name);
if (result != null) {
return depths[i][name]; // BUG: should be `return result;`
}
}
},
container.lookupProperty()
hasOwnProperty
resultIsAllowed()
container.lookup()
lookupProperty
result != null
depths[i][name]
lookupProperty
## Workarounds
{ compat: true }
Ensure context data objects are plain JSON (
Wiz
GHSA-7rx3-28cr-v5wh Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.6
[MEDIUM] GHSA-7rx3-28cr-v5wh Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-7rx3-28cr-v5wh :
Handlebars vulnerability analysis and mitigation
## Summary
lib/handlebars/internal/proto-access.js
constructor
__defineGetter__
__defineSetter__
__lookupGetter__
__lookupSetter__
allowProtoMethodsByDefault: true
__lookupSetter__
4.6.0
protoAccessControl
allowProtoMethodsByDefault
## Description
lib/handlebars/internal/proto-access.js
const methodWhiteList = Object.create(null);
methodWhiteList['constructor'] = false;
methodWhiteList['__defineGetter__'] = false;
methodWhiteList['__defineSetter__'] = false;
methodWhiteList['__lookupGetter__'] = false;
// __lookupSetter__ intentionally blocked in CVE-2021-23383,
// but omitted here — creating an asymmetric blocklist
__defineGetter__
__defineSetter__
__lookupGetter__
__lookupSetter__
__lookupSe
Wiz
CVE-2026-33940 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.8
CVE-2026-33940 [LOW] CVE-2026-33940 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33940 :
Grafana vulnerability analysis and mitigation
resolvePartial()
invokePartial()
undefined
env.compile()
require('handlebars/runtime')
compile()
invokePartial
{{> (lookup ...)}}
Wiz Threat Research note: Wiz has overridden initial access potential to FALSE since the vulnerability is only exploitable under specific conditions.
Source : NVD
## 8.1
Score
Published March 27, 2026
Severity HIGH
CNA Score 8.1
Affected Technologies
Grafana
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.1
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
lerna
handlebars
Sources
NVD
Chainguard Has Fix Added at: Mar 31, 2026
Debian 11, 12, 13 Sever
Bugzilla
CVE-2026-33940 nextcloud: Handlebars.js: Arbitrary code execution via crafted template context [epel-all]
bugzilla·2026-03-28·CVSS 8.1
CVE-2026-33940 [HIGH] CVE-2026-33940 nextcloud: Handlebars.js: Arbitrary code execution via crafted template context [epel-all]
CVE-2026-33940 nextcloud: Handlebars.js: Arbitrary code execution via crafted template context [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-cb5661d883 (nextcloud-33.0.3-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-cb5661d883
---
FEDORA-EPEL-2026-f7ea7872a6 (nextcloud-33.0.3-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f7ea7872a6
---
FEDORA-EPEL-2026-6610e2eca4 (nextcloud-33.0.3-1.el10_2) has been submitted as an update to Fedora EPEL 10.2.
Bugzilla
CVE-2026-33940 nextcloud: Handlebars.js: Arbitrary code execution via crafted template context [fedora-all]
bugzilla·2026-03-28·CVSS 8.1
CVE-2026-33940 [HIGH] CVE-2026-33940 nextcloud: Handlebars.js: Arbitrary code execution via crafted template context [fedora-all]
CVE-2026-33940 nextcloud: Handlebars.js: Arbitrary code execution via crafted template context [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-cb5661d883 (nextcloud-33.0.3-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-cb5661d883
---
FEDORA-EPEL-2026-f7ea7872a6 (nextcloud-33.0.3-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f7ea7872a6
---
FEDORA-EPEL-2026-6610e2eca4 (nextcloud-33.0.3-1.el10_2) has been submitted as an update to Fedora EPEL 10.
Bugzilla
CVE-2026-33940 openbao: Handlebars.js: Arbitrary code execution via crafted template context [fedora-all]
bugzilla·2026-03-28·CVSS 8.1
CVE-2026-33940 [HIGH] CVE-2026-33940 openbao: Handlebars.js: Arbitrary code execution via crafted template context [fedora-all]
CVE-2026-33940 openbao: Handlebars.js: Arbitrary code execution via crafted template context [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
OpenBao does not have any javascript in the server, so this vulnerability is not applicable.
Bugzilla
CVE-2026-33940 openbao: Handlebars.js: Arbitrary code execution via crafted template context [epel-all]
bugzilla·2026-03-28·CVSS 8.1
CVE-2026-33940 [HIGH] CVE-2026-33940 openbao: Handlebars.js: Arbitrary code execution via crafted template context [epel-all]
CVE-2026-33940 openbao: Handlebars.js: Arbitrary code execution via crafted template context [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
OpenBao does not have any javascript in the server, so this vulnerability is not applicable.
Bugzilla
CVE-2026-33940 handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context
bugzilla·2026-03-27·CVSS 8.1
CVE-2026-33940 [HIGH] CVE-2026-33940 handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context
CVE-2026-33940 handlebars.js: Handlebars.js: Arbitrary code execution via crafted template context
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `undefined`. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to `env.compile()`. Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds
https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6https://access.redhat.com/errata/RHSA-2026:10175https://access.redhat.com/security/cve/CVE-2026-33940https://bugzilla.redhat.com/show_bug.cgi?id=2452521https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33940.json
2026-03-27
Published