CVE-2026-33916

A flaw was found in Handlebars. The resolvePartial() function in the Handlebars runtime does not properly guard against prototype-chain traversal when resolving partial names. This allows an attacker to inject malicious code into web pages. When Object.prototype has been polluted with a string value that matches a partial reference, the polluted string is used as the partial body and rendered without proper HTML escaping. This can result in reflected or stored Cross-Site Scripting (XSS), potentially leading to arbitrary code execution in a user's browser or information disclosure.

Moderate: This vulnerability in Handlebars allows for Cross-Site Scripting (XSS) when an application uses Handlebars versions 4.0.0 through 4.7.8 and is susceptible to prototype pollution. An attacker could inject malicious code into web pages, potentially leading to arbitrary code execution in a user's browser or information disclosure. This affects Red Hat products that embed or utilize vulnerable versions of the Handlebars library.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, apply Object.freeze(Object.prototype) early in the application startup to prevent prototype pollution. Alternatively, use the Handlebars runtime-only build (handlebars/runtime), which reduces the attack surface by not compiling templates. Be aware that applying Object.freeze(Object.prototype) may impact the functionality of other libraries within the application. Applications utilizing Handlebars may require a restart for these changes to take effect.