Junglewise Threat Intelligence

CVE-2026-33940: Handlebars.js remote code execution via AST type confusion

CVE-2026-33940 · Severity: high · CVSS 8.1 · Published 2026-03-27

Technologies: Handlebars-Lang Handlebars.Js.

Executive brief

Handlebars is a popular library used to generate web pages and other documents from templates. A security flaw in certain versions allows an attacker to inject malicious code into the server's memory by providing a specially crafted data object. If successful, this could allow the attacker to take full control of the server, steal sensitive data, or disrupt operations.

Technical details

A type confusion vulnerability exists in the Handlebars runtime within the `resolvePartial()` and `invokePartial()` functions. By providing a crafted object with a `call: true` property in the template context, an attacker can bypass conditional guards in `resolvePartial()`, causing `invokePartial()` to return `undefined`. The runtime then incorrectly treats this object as an uncompiled partial and passes it to `env.compile()`. Since the crafted object is a valid Handlebars AST containing injected code, the resulting JavaScript executes arbitrary commands on the server. This exploit requires the attacker to control a value used in a dynamic partial lookup (e.g., `{{> (lookup ...)}}`). The issue is fixed in version 4.7.9.

Affected products

  • handlebars-lang handlebars.js >= 4.0.0, <= 4.7.8

Timeline

  • 2026-03-24: other: Fix authored
  • 2026-03-26: patched: Version 4.7.9 released
  • 2026-03-27: disclosed: CVE published

References