Code Injection in handlebars.js - CVE-2026-33938

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU124841

Code Injection in handlebars.js - CVE-2026-33938

Published: April 2, 2026


Vulnerability identifier: #VU124841
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33938
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to code injection through type confusion in the @partial-block handling and dynamic compilation fallback when processing a tampered @partial-block value during partial invocation. A remote attacker can overwrite @partial-block with a crafted Handlebars AST to execute arbitrary code.

The issue affects handlebars.js when templates can reach and mutate the data frame, and a subsequent {{> @partial-block}} causes the crafted AST to be compiled and executed in the server process.


Affected software

handlebars.js
Storage Defender Copy Data Management
MongoDB Enterprise Advanced with IBM
Fedora
IBM App Connect Enterprise
nextcloud

How to mitigate CVE-2026-33938

Install security update from vendor's website.

handlebars.js - update to 4.7.9
Storage Defender Copy Data Management - update to 2.3.1.0
MongoDB Enterprise Advanced with IBM - update to 8.0.25
IBM App Connect Enterprise - addressed in versions 12.0.12.25, 13.0.7.1
nextcloud - addressed in versions 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44

External References

Related Security Bulletins