Is CVE-2026-33938 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33938 being exploited in the wild.

How severe is CVE-2026-33938?

High severity, with a CVSS score of 8.1, published 27 March 2026.

Which products and versions are affected?

Handlebars handlebars.js 4.0.0 through 4.7.8.

Is there a fix for CVE-2026-33938?

A patch was published on 2026-03-26: Fix committed; version 4.7.9 released 2026-03-26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33938 attacked?

It is attacked over the network.

Am I affected by CVE-2026-33938?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33938: Handlebars.js remote code execution via @partial-block AST injection

CVE-2026-33938 · Severity: high · CVSS 8.1 · Published 2026-03-27

Handlebars.js is a popular template engine used in web applications to render dynamic content. A vulnerability allows attackers to inject and execute arbitrary JavaScript code on the server by manipulating the @partial-block template variable through helper functions. This could enable complete server compromise, data theft, and lateral movement within the application infrastructure.

Quick answers

Is CVE-2026-33938 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33938 being exploited in the wild.
How severe is CVE-2026-33938?: High severity, with a CVSS score of 8.1, published 27 March 2026.
Which products and versions are affected?: Handlebars handlebars.js 4.0.0 through 4.7.8.
Is there a fix for CVE-2026-33938?: A patch was published on 2026-03-26: Fix committed; version 4.7.9 released 2026-03-26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33938 attacked?: It is attacked over the network.
Am I affected by CVE-2026-33938?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a type-confusion issue in how Handlebars handles the @partial-block special variable. This variable is stored in the mutable template data context and is accessible to helper functions. Attackers can use helpers (such as the "merge" helper from the handlebars-helpers package) that accept object references and assign properties to overwrite @partial-block with a crafted AST object. When {{> @partial-block}} is evaluated, the runtime falls back to dynamically compiling the value via env.compile() if it is not a pre-compiled function. If the crafted object is a well-formed Handlebars AST containing injected code, the JavaScript executes in the server process. The attack requires templates and/or context data influenced by untrusted input, but does not require authentication or user interaction. Patches are available in version 4.7.9 and later. Mitigation includes using the runtime-only build (without compile capability) and auditing helper functions to ensure they do not write arbitrary values to context objects.

Affected products

Handlebars handlebars.js 4.0.0 through 4.7.8

Identifiers

CVE-2026-33938
GHSA-3mfm-83xf-c92r

Timeline

2026-03-27: disclosed: GHSA-3mfm-83xf-c92r advisory published
2026-03-26: patched: Fix committed; version 4.7.9 released 2026-03-26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.