CVE-2026-33937 handlebars-lang CVE debrief

Who should care

Developers and administrators using Handlebars in their applications should be aware of this vulnerability. Given the critical severity and high impact of this vulnerability, immediate attention is required to ensure that Handlebars is updated to a secure version. This is particularly important for applications exposed to untrusted input or user-supplied data.

Technical summary

The Handlebars templating engine for Node.js has a vulnerability that allows for Remote Code Execution (RCE). This occurs because the `Handlebars.compile()` function accepts a pre-parsed AST object in addition to a template string. Specifically, the `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without proper quoting or sanitization. An attacker who can supply a crafted AST can inject and execute arbitrary JavaScript, leading to RCE on the server. The vulnerability is rated as Critical with a CVSS score of 9.8. It affects Handlebars versions from 4.0.0 up to but not including 4.7.9.

Defensive priority

This vulnerability should be prioritized for immediate remediation due to its critical severity and the potential for high impact. Updating Handlebars to version 4.7.9 or later is essential.

Recommended defensive actions

• Update Handlebars to version 4.7.9 or later.
• Validate input type before calling `Handlebars.compile()` to ensure it is always a string.
• Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Review and update security policies to include checks for Handlebars version and configuration.

Evidence notes

The CVE-2026-33937 vulnerability was publicly disclosed on March 27, 2026, and has since been modified on June 30, 2026. The vulnerability affects Handlebars versions 4.0.0 through 4.7.8 and allows for Remote Code Execution (RCE). The CVSS score for this vulnerability is 9.8, indicating critical severity. The vulnerability was patched in Handlebars version 4.7.9.

Official resources