CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
Attackers can inject arbitrary JavaScript into Handlebars templates via crafted AST objects, leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33937?
CVE-2026-33937 is a critical code injection vulnerability in handlebars-lang handlebars.js, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable.
Which versions are affected by CVE-2026-33937?
2 open source packages ship an affected version, including handlebars. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | From 4.0.0 | 4.7.9 |
handlebars npm | From 4.0.0 | 4.7.9 |
Products include Handlebarsjs Handlebars.
How do I fix CVE-2026-33937?
Upgrade handlebars to 4.7.9 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-33937 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33937 exists.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in handlebars-lang handlebars.js
- CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- CVE-2019-20920 Arbitrary Code Execution in Handlebars
- CVE-2026-33939 Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Sources
Also known as CLEANSTART-2026-CI51547, CLEANSTART-2026-EC90376, DEBIAN-CVE-2026-33937, GHSA-2w6w-674q-4c4q, MINI-37rx-w7wh-w67x, MINI-53pg-78mf-c5ff and 14 more.