Junglewise Threat Intelligence

CVE-2026-33941: Handlebars handlebars.js code injection in CLI precompiler

CVE-2026-33941 · Severity: high · CVSS 8.2 · Published 2026-03-27

Technologies: Handlebars-Lang Handlebars.Js, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Executive brief

Handlebars is a popular tool used by developers to create web templates. A security flaw in its command-line tool allows an attacker to hide malicious code inside template filenames or configuration settings. If a developer or an automated system processes these malicious files, the hidden code will execute, potentially allowing the attacker to steal data, modify files, or take control of the build environment.

Technical details

The Handlebars CLI precompiler (bin/handlebars and lib/precompiler.js) is vulnerable to code injection because it performs direct string concatenation of user-controlled inputs into the generated JavaScript output. Specifically, template filenames, the namespace option (-n), the CommonJS path (-c), and the AMD path (-h) are interpolated without escaping. An attacker who can influence these inputs—such as by submitting a malicious filename to a repository or manipulating build arguments—can inject arbitrary JavaScript. This code executes when the resulting bundle is loaded in Node.js or a browser environment. The issue is fixed in version 4.7.9.

Affected products

  • handlebars-lang handlebars.js 4.0.0 - 4.7.8
  • Red Hat Enterprise Linux 8 8
  • Red Hat Enterprise Linux 9 9
  • Red Hat Enterprise Linux 10 10
  • Red Hat OpenShift Dev Spaces 3.27

Timeline

  • 2026-03-26: patched: Version 4.7.9 released
  • 2026-03-27: disclosed: Public advisory published

References

Related threats