Junglewise Threat Intelligence

CVE-2026-33938: Handlebars.js remote code execution via @partial-block AST injection

CVE-2026-33938 · Severity: high · CVSS 8.1 · Published 2026-03-27

Technologies: Handlebars.Js.

Executive brief

Handlebars.js is a popular template engine used in web applications to render dynamic content. A vulnerability allows attackers to inject and execute arbitrary JavaScript code on the server by manipulating the @partial-block template variable through helper functions. This could enable complete server compromise, data theft, and lateral movement within the application infrastructure.

Technical details

The vulnerability stems from a type-confusion issue in how Handlebars handles the @partial-block special variable. This variable is stored in the mutable template data context and is accessible to helper functions. Attackers can use helpers (such as the "merge" helper from the handlebars-helpers package) that accept object references and assign properties to overwrite @partial-block with a crafted AST object. When {{> @partial-block}} is evaluated, the runtime falls back to dynamically compiling the value via env.compile() if it is not a pre-compiled function. If the crafted object is a well-formed Handlebars AST containing injected code, the JavaScript executes in the server process. The attack requires templates and/or context data influenced by untrusted input, but does not require authentication or user interaction. Patches are available in version 4.7.9 and later. Mitigation includes using the runtime-only build (without compile capability) and auditing helper functions to ensure they do not write arbitrary values to context objects.

Affected products

  • Handlebars handlebars.js 4.0.0 through 4.7.8

Timeline

  • 2026-03-27: disclosed: GHSA-3mfm-83xf-c92r advisory published
  • 2026-03-26: patched: Fix committed; version 4.7.9 released 2026-03-26

References