CVE-2026-33941
Full vulnerability record from the local CVENow database.
Description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (`"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated build pipeline.
Severity
HIGH
CVSS score
8.2
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-03-27 22:16:21.203000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-33941",
"sourceIdentifier": "[email protected]",
"published": "2026-03-27T22:16:21.203",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (`\"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated build pipeline."
},
{
"lang": "es",
"value": "Handlebars proporciona la potencia necesaria para permitir a los usuarios construir plantillas semánticas. En las versiones 4.0.0 a 4.7.8, el precompilador CLI de Handlebars (bin/handlebars / lib/precompiler.js) concatena cadenas controladas por el usuario - nombres de archivos de plantilla y varias opciones CLI - directamente en el JavaScript que emite, sin ningún escape o saneamiento. Un atacante que puede influir en los nombres de archivo de plantilla o los argumentos CLI puede inyectar JavaScript arbitrario que se ejecuta cuando el paquete generado se carga en Node.js o un navegador. La versión 4.7.9 corrige el problema. Algunas soluciones alternativas están disponibles. Primero, valide todas las entradas CLI antes de invocar el precompilador. Rechace los nombres de archivo y los valores de opción que contengan caracteres con significado de escape de cadena de JavaScript (”, ’, ;, etc.). Segundo, utilice una cadena de espacio de nombres fija y de confianza pasada a través de un archivo de configuración en lugar de argumentos de línea de comandos en pipelines automatizados. Tercero, ejecute el precompilador en un entorno aislado (contenedor sin acceso de escritura a rutas sensibles) para limitar el impacto de una explotación exitosa. Cuarto, audite los nombres de archivo de plantilla en cualquier repositorio o paquete que sea consumido por un pipeline de compilación automatizado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "handlebars-lang",
"product": "handlebars.js",
"versions": [
{
"version": ">= 4.0.0, < 4.7.9",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9",
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"versions": [
{
"version": "1782839279",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9",
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"versions": [
{
"version": "1782840539",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9",
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"versions": [
{
"version": "1782839996",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "devspaces/code-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"versions": [
{
"version": "1776744110",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cryostat 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "handlebars",
"cpes": [
"cpe:/a:redhat:cryostat:4"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch6-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-operator-bundle",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-proxy-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/elasticsearch-rhel9-operator",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/kibana6-rhel8",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-logging/logging-curator5-rhel9",
"cpes": [
"cpe:/a:redhat:logging:5"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Data Grid 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "handlebars",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "389-ds:1.4/389-ds-base",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "grafana",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mozjs60",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "firefox",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "thunderbird",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Process Automation 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "handlebars",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.5,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.5,
"impactScore": 6.0
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.5,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-03-31T00:00:00+00:00",
"id": "CVE-2026-33941",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-94"
},
{
"lang": "en",
"value": "CWE-116"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "4.7.9",
"matchCriteriaId": "A9D1F9A7-8359-4C3F-9932-4A085094F388"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:10175",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34342",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33941",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452524",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}