Is CVE-2026-33937 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33937 being exploited in the wild.

How severe is CVE-2026-33937?

Critical severity, with a CVSS score of 9.8, published 27 March 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 10 10; Red Hat Enterprise Linux 8 8; Red Hat Enterprise Linux 9 9.

Is there a fix for CVE-2026-33937?

A patch was published on 2026-03-26: v4.7.9 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33937 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33937?

Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33937: Handlebars.js remote code execution via AST type confusion in compile

CVE-2026-33937 · Severity: critical · CVSS 9.8 · Published 2026-03-27

Handlebars.js is a widely-used templating engine for Node.js and browsers. The library's compile() function can accept either a template string or a pre-parsed AST object. An attacker who controls the AST input—for example, through JSON deserialization of user data—can craft a malicious NumberLiteral node that executes arbitrary JavaScript code on the server, leading to complete system compromise including data theft and command execution.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-33937 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33937 being exploited in the wild.
How severe is CVE-2026-33937?: Critical severity, with a CVSS score of 9.8, published 27 March 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 10 10; Red Hat Enterprise Linux 8 8; Red Hat Enterprise Linux 9 9.
Is there a fix for CVE-2026-33937?: A patch was published on 2026-03-26: v4.7.9 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33937 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33937?: Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in lib/handlebars/compiler/javascript-compiler.js, where NumberLiteral AST node values are appended to generated code without quoting or sanitization. When a crafted AST with a malicious NumberLiteral value (e.g., "{},'}} + process.getBuiltinModule('child_process').execFileSync('id')") is passed to compile(), the injected code breaks out of its intended scope and executes with full privileges. The vulnerability affects versions 4.0.0 through 4.7.8. Attack requires the application to deserialize untrusted JSON and pass it directly to Handlebars.compile()—a pattern common in REST APIs that accept template definitions from clients. No user interaction is required; exploitation is immediate upon request. Patch available in v4.7.9 (released 2026-03-26); workaround is to validate input type and only accept strings, never pre-parsed objects.

Affected products

Handlebars handlebars.js 4.0.0 to 4.7.8

Identifiers

CVE-2026-33937
GHSA-2w6w-674q-4c4q

Timeline

2026-03-27: disclosed: GHSA published
2026-03-26: patched: v4.7.9 released with fix
2026-03-27: kev added

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.