CVE-2026-33937 - Vulnerability Analysis

Overview

Handlebars 4.0.0 through 4.7.8 contains a remote code execution caused by unsanitized NumberLiteral AST node value in Handlebars.compile(), letting attackers inject and execute arbitrary JavaScript, exploit requires attacker to supply crafted AST.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript on the server, leading to full remote code execution and server compromise.

Mitigation

Upgrade to version 4.7.9 or later.

References

• https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
• https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
• https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 27, 2026

⚠️ CRITICAL: handlebars.js v4.0.0 – 4.7.8 vulnerable (CVE-2026-33937). Type confusion in compile() lets attackers inject JS & gain RCE via crafted AST. Upgrade to 4.7.9+, validate inputs, use runtime-only build if possible. https://radar.offseq.com/threat/cve-2026-33937-cwe-843-access-of-resource-using-in-5708b559 #OffSeq #CVE202633937 #infosec

View original post

GitHub Repositories(1 repo)

• https://github.com/dinhvaren/cve-2026-33937

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner