Is CVE-2026-33941 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33941 being exploited in the wild.

How severe is CVE-2026-33941?

High severity, with a CVSS score of 8.2, published 27 March 2026.

Which products and versions are affected?

handlebars (npm) SEMVER:introduced=4.0.0,fixed=4.7.9; Red Hat Enterprise Linux 10 10; Red Hat Enterprise Linux 8 8; Red Hat Enterprise Linux 9 9.

Is there a fix for CVE-2026-33941?

Yes. handlebars (npm): upgrade to 4.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33941 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-33941?

Check whether you run handlebars (npm), Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33941: Handlebars handlebars.js code injection in CLI precompiler

CVE-2026-33941 · Severity: high · CVSS 8.2 · Published 2026-03-27

Handlebars is a popular tool used by developers to create web templates. A security flaw in its command-line tool allows an attacker to hide malicious code inside template filenames or configuration settings. If a developer or an automated system processes these malicious files, the hidden code will execute, potentially allowing the attacker to steal data, modify files, or take control of the build environment.

Technologies: handlebars (npm), Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-33941 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33941 being exploited in the wild.
How severe is CVE-2026-33941?: High severity, with a CVSS score of 8.2, published 27 March 2026.
Which products and versions are affected?: handlebars (npm) SEMVER:introduced=4.0.0,fixed=4.7.9; Red Hat Enterprise Linux 10 10; Red Hat Enterprise Linux 8 8; Red Hat Enterprise Linux 9 9.
Is there a fix for CVE-2026-33941?: Yes. handlebars (npm): upgrade to 4.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33941 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-33941?: Check whether you run handlebars (npm), Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

handlebars (npm): upgrade to 4.7.9 or later
```
npm install handlebars@4.7.9
```

Technical details

The Handlebars CLI precompiler (bin/handlebars and lib/precompiler.js) is vulnerable to code injection because it performs direct string concatenation of user-controlled inputs into the generated JavaScript output. Specifically, template filenames, the namespace option (-n), the CommonJS path (-c), and the AMD path (-h) are interpolated without escaping. An attacker who can influence these inputs—such as by submitting a malicious filename to a repository or manipulating build arguments—can inject arbitrary JavaScript. This code executes when the resulting bundle is loaded in Node.js or a browser environment. The issue is fixed in version 4.7.9.

Affected products

handlebars-lang handlebars.js 4.0.0 - 4.7.8
Red Hat Enterprise Linux 8 8
Red Hat Enterprise Linux 9 9
Red Hat Enterprise Linux 10 10
Red Hat OpenShift Dev Spaces 3.27

Identifiers

CVE-2026-33941
GHSA-xjpj-3mr7-gcpf

Timeline

2026-03-26: patched: Version 4.7.9 released
2026-03-27: disclosed: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.