Code Injection in handlebars.js - CVE-2026-33937

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU124842

Code Injection in handlebars.js - CVE-2026-33937

Published: April 2, 2026 / Updated: April 30, 2026


Vulnerability identifier: #VU124842
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33937
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in Handlebars.compile() and the JavaScript code generator when processing a crafted pre-parsed AST object. A remote attacker can supply a crafted AST with a malicious NumberLiteral value to execute arbitrary code.

The issue affects cases where user-controlled JSON or other untrusted input is deserialized and passed directly to compile() as an AST object instead of a template string, and no user interaction is required.


Affected software

handlebars.js
Storage Defender Copy Data Management
MongoDB Enterprise Advanced with IBM
Fedora
IBM App Connect Enterprise
nextcloud

How to mitigate CVE-2026-33937

Install security update from vendor's website.

handlebars.js - update to 4.7.9
Storage Defender Copy Data Management - update to 2.3.1.0
MongoDB Enterprise Advanced with IBM - update to 8.0.25
IBM App Connect Enterprise - addressed in versions 12.0.12.25, 13.0.7.1
nextcloud - addressed in versions 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins