CVE-2026-33916 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Prototype pollution in Handlebars.js allows attackers to inject malicious scripts via partial templates, leading to cross-site scripting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33916?
CVE-2026-33916 is a medium-severity cross-site scripting vulnerability in handlebars-lang handlebars.js, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.
Which versions are affected by CVE-2026-33916?
2 open source packages ship an affected version, including handlebars. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | From 4.0.0 | 4.7.9 |
handlebars npm | From 4.0.0 | 4.7.9 |
Products include Handlebarsjs Handlebars.
How do I fix CVE-2026-33916?
Upgrade handlebars to 4.7.9 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33916 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33916 exists.
Other vulnerabilities in handlebars-lang handlebars.js
- CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
- CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- CVE-2019-20920 Arbitrary Code Execution in Handlebars
Sources
Also known as CLEANSTART-2026-BA07139, CLEANSTART-2026-UA73241, DEBIAN-CVE-2026-33916, GHSA-2qvq-rjwj-gvw9, MINI-44jc-3hjp-j8p9, MINI-4ffv-qvgc-9gc9 and 14 more.