Code Injection Risk in Handlebars CLI Precompiler for Node.js

CVE-2026-33941

What is CVE-2026-33941?

The Handlebars CLI precompiler prior to version 4.7.9 is vulnerable due to improper handling of user-input strings, such as template filenames and CLI arguments. An attacker can exploit this vulnerability by injecting malicious JavaScript into the generated output, which may execute within Node.js or browser environments. To mitigate this risk, it is essential to validate CLI inputs, utilize a trusted namespace, deploy a sandboxed precompiler environment, and conduct audits of template files in automated build setups.

References