Code Injection in handlebars.js - CVE-2026-33941

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU124843

Code Injection in handlebars.js - CVE-2026-33941

Published: April 2, 2026


Vulnerability identifier: #VU124843
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33941
CWE-ID: CWE-94
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary JavaScript code.

The vulnerability exists due to improper neutralization of user-controlled input in the Handlebars CLI precompiler when generating JavaScript output from template file names and CLI options. A local user can supply specially crafted template names or option values to execute arbitrary JavaScript code.

The issue affects bin/handlebars and lib/precompiler.js through multiple injection points involving template names, namespace values, CommonJS paths, and AMD paths, and the injected code executes when the generated bundle is loaded in Node.js or a browser. User interaction is required to load the generated bundle.


Affected software

handlebars.js
Storage Defender Copy Data Management
MongoDB Enterprise Advanced with IBM
Fedora
IBM App Connect Enterprise
nextcloud

How to mitigate CVE-2026-33941

Install security update from vendor's website.

handlebars.js - update to 4.7.9
Storage Defender Copy Data Management - update to 2.3.1.0
MongoDB Enterprise Advanced with IBM - update to 8.0.25
IBM App Connect Enterprise - addressed in versions 12.0.12.25, 13.0.7.1
nextcloud - addressed in versions 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44

External References

Related Security Bulletins