CVE-2026-33938

A flaw was found in Handlebars. A remote attacker can exploit this vulnerability by manipulating the @partial-block special variable within the template data context. By overwriting @partial-block with a specially crafted Abstract Syntax Tree (AST) through a helper, a subsequent invocation of {{> @partial-block}} will compile and execute the malicious AST. This enables arbitrary JavaScript execution on the server, leading to potential compromise of the system.

Important: A flaw in Handlebars allows arbitrary code execution when processing untrusted input. This occurs if an attacker can manipulate the @partial-block special variable through a helper, leading to the execution of a crafted Abstract Syntax Tree. Red Hat products are affected if they use Handlebars versions 4.0.0 through 4.7.8 in server-side applications where untrusted input can influence template data or context objects. Deployments utilizing the Handlebars runtime-only build are not vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications using Handlebars should implement the runtime-only build (require('handlebars/runtime')) to prevent exploitation, as this build lacks the vulnerable compile() method. Additionally, review all registered helpers to ensure they do not write arbitrary values to context objects, and avoid using third-party helpers in contexts exposed to untrusted input.