Cross-site scripting in handlebars.js - CVE-2026-33916
Published: April 2, 2026
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script code in a victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in resolvePartial() and invokePartial() in the Handlebars runtime when rendering a partial whose name is resolved through a polluted prototype chain. A remote attacker can pollute Object.prototype with a string value matching a partial reference to execute arbitrary script code in a victim's browser.
Exploitation requires a prototype pollution condition in the target application and user interaction to render a template that references the attacker-chosen partial name. The injected partial content is rendered without HTML escaping, which can result in reflected or stored cross-site scripting.
Affected software
Storage Defender Copy Data Management
Fedora
IBM App Connect Enterprise
nextcloud
How to mitigate CVE-2026-33916
Storage Defender Copy Data Management - update to 2.3.1.0
IBM App Connect Enterprise - addressed in versions 12.0.12.25, 13.0.7.1
nextcloud - addressed in versions 33.0.1-1.el10_1, 33.0.1-1.fc42, 33.0.3-1.el10_2, 33.0.3-1.el10_3, 33.0.3-1.fc42, 33.0.3-1.fc43, 33.0.3-1.fc44
External References
Related Security Bulletins
- Multiple vulnerabilities in handlebars.js
- Multiple vulnerabilities in IBM App Connect Enterprise
- Fedora EPEL 10.1 update for nextcloud
- Fedora 42 update for nextcloud
- Fedora 44 update for nextcloud
- Fedora 43 update for nextcloud
- Fedora EPEL 10.3 update for nextcloud
- Fedora EPEL 10.2 update for nextcloud
- Fedora 42 update for nextcloud
- Multiple vulnerabilities in IBM Storage Defender Copy Data Management