Cross-Site Scripting Vulnerability in Handlebars by Handlebars Team

CVE-2026-33916

What is CVE-2026-33916?

The Handlebars template engine contains a vulnerability that allows attackers to exploit resolvePartial() through a lack of protection against prototype-chain traversal. By manipulating Object.prototype to include malicious values, an attacker can have their payload executed as part of the template rendering process, leading to reflected or stored XSS attacks. Versions 4.0.0 to 4.7.8 are susceptible, allowing injected scripts to run in the context of the user's session. Update to Handlebars version 4.7.9 to mitigate this risk, or consider implementing workarounds such as freezing the prototype to limit exposure.

References