CVE-2026-33937

A flaw was found in Handlebars. An attacker can exploit this by supplying a crafted Abstract Syntax Tree (AST) object to the Handlebars.compile() function. This allows the injection and execution of arbitrary JavaScript code due to improper sanitization of the value field in NumberLiteral AST nodes. This vulnerability can lead to Remote Code Execution (RCE) on the server.

This is an Important vulnerability in Handlebars that allows for Remote Code Execution. The flaw occurs when the Handlebars.compile() function processes a specially crafted Abstract Syntax Tree (AST) object, leading to the injection and execution of arbitrary JavaScript code. Red Hat products utilizing Handlebars are affected if they process untrusted input through the compile() function.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that any input provided to the Handlebars.compile() function is strictly validated to be a string type, preventing the injection of crafted Abstract Syntax Tree (AST) objects. Additionally, for deployments where templates are pre-compiled at build time, consider utilizing the Handlebars runtime-only build (handlebars/runtime). This build variant does not include the compile() function, thereby eliminating the attack vector. If the application is a service, a restart may be required for the changes to take effect.