CVE-2026-33938
Full vulnerability record from the local CVENow database.
Description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in contexts where templates or context data can be influenced by untrusted input.
Severity
HIGH
CVSS score
8.1
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-03-27 21:17:27.587000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-33938",
"sourceIdentifier": "[email protected]",
"published": "2026-03-27T21:17:27.587",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in contexts where templates or context data can be influenced by untrusted input."
},
{
"lang": "es",
"value": "Handlebars proporciona la potencia necesaria para permitir a los usuarios construir plantillas semánticas. En las versiones 4.0.0 a 4.7.8, la variable especial “@partial-block” se almacena en el contexto de datos de la plantilla y es accesible y mutable desde dentro de una plantilla a través de helpers que aceptan objetos arbitrarios. Cuando un helper sobrescribe “@partial-block” con un AST de Handlebars manipulado, una invocación posterior de “{{> @partial-block}}” compila y ejecuta ese AST, permitiendo la ejecución arbitraria de JavaScript en el servidor. La versión 4.7.9 corrige el problema. Hay algunas soluciones alternativas disponibles. Primero, use la compilación solo en tiempo de ejecución (“require(’handlebars/runtime’)”). El método “compile()” está ausente, eliminando la ruta de reserva vulnerable. Segundo, audite los helpers registrados en busca de cualquiera que escriba valores arbitrarios en objetos de contexto. Los helpers deben tratar los datos de contexto como de solo lectura. Tercero, evite registrar helpers de paquetes de terceros (como “handlebars-helpers”) en contextos donde las plantillas o los datos de contexto puedan ser influenciados por entradas no confiables."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "handlebars-lang",
"product": "handlebars.js",
"versions": [
{
"version": ">= 4.0.0, < 4.7.9",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9",
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"versions": [
{
"version": "1782839279",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9",
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"versions": [
{
"version": "1782840539",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9",
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"versions": [
{
"version": "1782839996",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "devspaces/code-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"versions": [
{
"version": "1776744110",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cryostat 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "handlebars",
"cpes": [
"cpe:/a:redhat:cryostat:4"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch6-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-operator-bundle",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-proxy-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-rhel9-operator",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/kibana6-rhel8",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/logging-curator5-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Data Grid 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "handlebars",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4/389-ds-base",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "grafana",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mozjs60",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "devspaces/dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Process Automation 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "handlebars",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-03-31T00:00:00+00:00",
"id": "CVE-2026-33938",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
},
{
"lang": "en",
"value": "CWE-843"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-917"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "4.7.9",
"matchCriteriaId": "A9D1F9A7-8359-4C3F-9932-4A085094F388"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10175",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34342",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33938",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452525",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33938.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}