Arbitrary JavaScript Execution Vulnerability in Handlebars JavaScript Library

CVE-2026-33938

What is CVE-2026-33938?

In the Handlebars JavaScript library, a vulnerability exists that allows arbitrary JavaScript execution through the misuse of the @partial-block variable in versions 4.0.0 to 4.7.8. This issue arises when malicious scripts overwrite the @partial-block with a crafted Abstract Syntax Tree (AST), leading to severe security risks as it can be executed on the server with the invocation of the {{> @partial-block}} command. Users are advised to upgrade to version 4.7.9, which addresses this issue. Additionally, they should utilize the runtime-only build to mitigate risks and thoroughly audit helpers to prevent unsafe context data operations.

References