Is CVE-2026-33916 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33916 being exploited in the wild.

How severe is CVE-2026-33916?

Medium severity, with a CVSS score of 4.7, published 27 March 2026.

Which products and versions are affected?

handlebars-lang handlebars 4.0.0 to 4.7.8.

Is there a fix for CVE-2026-33916?

A patch was published on 2026-03-26: Version 4.7.9 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33916 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33916?

Check whether you run Handlebarsjs Handlebars. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33916: Handlebars.js prototype pollution XSS via partial template injection

CVE-2026-33916 · Severity: medium · CVSS 4.7 · Published 2026-03-27

Handlebars.js is a widely-used template engine for rendering dynamic content in web applications. A flaw in how it resolves partial templates allows an attacker to inject arbitrary HTML/JavaScript into rendered pages when the application is vulnerable to prototype pollution. An attacker can pollute JavaScript's Object.prototype and cause Handlebars to use a malicious string as a template partial, leading to cross-site scripting (XSS) attacks that steal user data or perform actions on their behalf.

Quick answers

Is CVE-2026-33916 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33916 being exploited in the wild.
How severe is CVE-2026-33916?: Medium severity, with a CVSS score of 4.7, published 27 March 2026.
Which products and versions are affected?: handlebars-lang handlebars 4.0.0 to 4.7.8.
Is there a fix for CVE-2026-33916?: A patch was published on 2026-03-26: Version 4.7.9 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33916 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33916?: Check whether you run Handlebarsjs Handlebars. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in lib/handlebars/runtime.js within resolvePartial() and invokePartial() functions. The code performs unguarded bracket-access property lookup (partial = options.partials[options.name]) that traverses the prototype chain without checking hasOwnProperty(). When Object.prototype has been seeded with a key matching a partial reference in a template (e.g., "widget"), the lookup succeeds and returns the polluted string value. Critically, this polluted content is rendered without HTML escaping, resulting in unescaped XSS. The attack requires two preconditions: (1) the target application must be vulnerable to prototype pollution via a separate vector such as qs, minimist, or JSON merge operations, and (2) the attacker must know or guess a partial name referenced in the template. Although the runtime prints a prototype access warning, the partial is still resolved and rendered, contradicting the documented security model. A patch is available in version 4.7.9.

Affected products

handlebars-lang handlebars 4.0.0 to 4.7.8

Identifiers

CVE-2026-33916
GHSA-2qvq-rjwj-gvw9

Timeline

2026-03-26: disclosed: GitHub Security Advisory GHSA-2qvq-rjwj-gvw9 published
2026-03-26: patched: Version 4.7.9 released with security fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.