Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, Handlebars.compile() accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to compile() can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling Handlebars.compile(); ensure the argument is always a string, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (handlebars/runtime) on the server if templates are pre-compiled at build time; compile() will be unavailable.
CVE-2026-33937
This critical-severity CVE scores 9.8 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- High severity, but no confirmed exploitation yet
A fix is available — apply it.
- CVSS v3
- 9.8
- EG Score
- 9.8(low)
- EPSS
- 75.6%
- KEV
- Not listed
Published
March 27, 2026
Last Modified
July 2, 2026
Advisory Details (8)
Auto-updated Jul 3, 2026Affected: Red Hat Enterprise Linux 10",
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33937.json2452523 – (CVE-2026-33937) CVE-2026-33937 handlebars.js: Handlebars: Remote Code Execution via crafted Abstract Syntax Tree object in compile()
https://bugzilla.redhat.com/show_bug.cgi?id=2452523JavaScript Injection via AST Type Confusion in compile · Advisory · handlebars-lang/handlebars.js · GitHub
https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4qv4.7.9
Patch available: handlebars-lang/handlebars.js v4.7.9
https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9commit 68d8df5a88e0 (handlebars-lang/handlebars.js)
Patch available: handlebars-lang/handlebars.js v4.7.9 (contains commit 68d8df5a88e0)
https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2Vendor Advisories for CVE-2026-33937(3)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
- RHSA-2026:34342Red Hat Product SecurityCritical
Red Hat Security Advisory: Cluster Observability Operator 1.5.0
- CVE-2026-33937Microsoft Security Response Center (MSRC)Critical
Handlebars.js has JavaScript Injection via AST Type Confusion
- RHSA-2026:10175Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.1 Release.
Patch Availability(1)
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| redhat | devspaces/code-rhel9:1776744110 | 2026-04-23 | redhat |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Affected Packages
(1 across 1 ecosystem)
npm(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| handlebars | — | 4.7.9 | — |
Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 8× in last 7d / 11× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-07-06 16:27 UTCEPSS rescore
- 2026-07-06 16:27 UTCEPSS rescore
- 2026-07-06 02:23 UTCEPSS rescore
- 2026-07-06 02:23 UTCEPSS rescore
- 2026-07-05 02:30 UTCEPSS rescore
- 2026-07-04 06:31 UTCEPSS rescore
- 2026-07-01 15:06 UTCEPSS rescore
- 2026-06-30 23:22 UTCEPSS rescore
- 2026-06-30 04:37 UTCEG score recompute
- 2026-06-30 04:37 UTCVendor advisory
- 2026-06-30 04:32 UTCNVD updatefirst tracked
Related CVEs(same vendor + same CWE)
Same vendor
10 shownredhat
Same CWE
10 shownCWE-94
- CVE-2006-1359NVD 0.0EG 9.0EPSS 99%NONE
- CVE-2005-1921NVD 0.0EG 9.0EPSS 100%NONE
- CVE-2005-3302EG 7.3HIGH
- CVE-2005-1876EG 4.5MEDIUM
- CVE-2003-1599EG 0.0NONE
- CVE-2006-1318EG 0.0EPSS 96%NONE
- CVE-2006-1301EG 0.0EPSS 95%NONE
- CVE-2006-1308EG 0.0EPSS 95%NONE
- CVE-2006-1309EG 0.0EPSS 95%NONE
- CVE-2006-1304EG 0.0EPSS 95%NONE
Frequently asked(5)
What is CVE-2026-33937?
When was CVE-2026-33937 disclosed?
Is CVE-2026-33937 actively exploited?
What is the CVSS score of CVE-2026-33937?
How do I remediate CVE-2026-33937?
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-33937
Is Your Infrastructure Affected by CVE-2026-33937?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.