# CVE-2026-33941: Handlebars handlebars.js code injection in CLI precompiler

Source: https://junglewise.ai/threats/cve-2026-33941-handlebars-handlebars-js-code-injection-in-cli-precompiler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33941 · Severity: high · CVSS 8.2 · Published 2026-03-27

Handlebars is a popular tool used by developers to create web templates. A security flaw in its command-line tool allows an attacker to hide malicious code inside template filenames or configuration settings. If a developer or an automated system processes these malicious files, the hidden code will execute, potentially allowing the attacker to steal data, modify files, or take control of the build environment.

Technologies: [handlebars (npm)](https://junglewise.ai/threats/technologies/npm-handlebars), [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-33941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33941 being exploited in the wild.

**How severe is CVE-2026-33941?** High severity, with a CVSS score of 8.2, published 27 March 2026.

**Which products and versions are affected?** handlebars (npm) SEMVER:introduced=4.0.0,fixed=4.7.9; Red Hat Enterprise Linux 10 10; Red Hat Enterprise Linux 8 8; Red Hat Enterprise Linux 9 9.

**Is there a fix for CVE-2026-33941?** Yes. handlebars (npm): upgrade to 4.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33941 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-33941?** Check whether you run handlebars (npm), Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- handlebars (npm): upgrade to 4.7.9 or later

  ```sh
  npm install handlebars@4.7.9
  ```


## Technical details

The Handlebars CLI precompiler (bin/handlebars and lib/precompiler.js) is vulnerable to code injection because it performs direct string concatenation of user-controlled inputs into the generated JavaScript output. Specifically, template filenames, the namespace option (-n), the CommonJS path (-c), and the AMD path (-h) are interpolated without escaping. An attacker who can influence these inputs—such as by submitting a malicious filename to a repository or manipulating build arguments—can inject arbitrary JavaScript. This code executes when the resulting bundle is loaded in Node.js or a browser environment. The issue is fixed in version 4.7.9.

## Affected products

- handlebars-lang handlebars.js 4.0.0 - 4.7.8
- Red Hat Enterprise Linux 8 8
- Red Hat Enterprise Linux 9 9
- Red Hat Enterprise Linux 10 10
- Red Hat OpenShift Dev Spaces 3.27

## Identifiers

- CVE-2026-33941
- GHSA-xjpj-3mr7-gcpf

## Timeline

- 2026-03-26: patched: Version 4.7.9 released
- 2026-03-27: disclosed: Public advisory published

## References

- [https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2](https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2)
- [https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9)
- [https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf)
- [https://access.redhat.com/errata/RHSA-2026:10175](https://access.redhat.com/errata/RHSA-2026:10175)
- [https://access.redhat.com/security/cve/CVE-2026-33941](https://access.redhat.com/security/cve/CVE-2026-33941)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452524](https://bugzilla.redhat.com/show_bug.cgi?id=2452524)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json)

## Related threats

- [Handlebars AST validation bypass in compile and precompile](https://junglewise.ai/threats/cve-2026-106446-handlebars-provides-the-power-necessary-to-let-users-build)
- [Handlebars prototype pollution RCE via constructor bypass](https://junglewise.ai/threats/cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build)
- [Handlebars precompile script injection in generated code](https://junglewise.ai/threats/cve-2026-106444-handlebars-provides-the-power-necessary-to-let-users-build)
- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)