rewindex

RewindexCVEs

CVE-2026-33938: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

High · CVSS 8.1 (CVSS 3.1)EPSS n/aPublished Updated Assigner: GitHub_M

Description

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in contexts where templates or context data can be influenced by untrusted input.

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-843, CWE-94

Status incidents that name it

Affected vendors and products

handlebars-lang: handlebars.jsRed Hat: Cluster Observability Operator 1.5.0Red Hat: Cryostat 4Red Hat: Logging Subsystem for Red Hat OpenShiftRed Hat: Red Hat Data Grid 8Red Hat: Red Hat Developer HubRed Hat: Red Hat Enterprise Linux 10Red Hat: Red Hat Enterprise Linux 7Red Hat: Red Hat Enterprise Linux 8Red Hat: Red Hat Enterprise Linux 9Red Hat: Red Hat OpenShift AI (RHOAI)Red Hat: Red Hat OpenShift Dev SpacesRed Hat: Red Hat OpenShift Dev Spaces 3.27Red Hat: Red Hat Process Automation 7

References

All CVEsMarkdownJSON