UBUNTU-CVE-2026-33938 (CVE-2026-33938)

Vulnerability from osv_ubuntu – Published: 2026-03-27 21:17 – Updated: 2026-06-30 16:20 – Source website
VLAI
Details

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites @partial-block with a crafted Handlebars AST, a subsequent invocation of {{> @partial-block}} compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (require('handlebars/runtime')). The compile() method is absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as handlebars-helpers) in contexts where templates or context data can be influenced by untrusted input.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
N/A (UNKNOWN)
medium
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "handlebars",
            "binary_version": "3:4.0.10-5"
          },
          {
            "binary_name": "libjs-handlebars",
            "binary_version": "3:4.0.10-5"
          },
          {
            "binary_name": "libjs-handlebars.runtime",
            "binary_version": "3:4.0.10-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "node-handlebars",
        "purl": "pkg:deb/ubuntu/node-handlebars@3:4.0.10-5?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:4.0.10-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "handlebars",
            "binary_version": "3:4.7.2-1"
          },
          {
            "binary_name": "libjs-handlebars",
            "binary_version": "3:4.7.2-1"
          },
          {
            "binary_name": "libjs-handlebars.runtime",
            "binary_version": "3:4.7.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "node-handlebars",
        "purl": "pkg:deb/ubuntu/node-handlebars@3:4.7.2-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:4.1.0-1",
        "3:4.5.3-1",
        "3:4.7.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars.runtime",
            "binary_version": "3:4.7.7+~4.1.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-handlebars",
        "purl": "pkg:deb/ubuntu/node-handlebars@3:4.7.7+~4.1.0-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:4.7.6+~4.1.0-2",
        "3:4.7.7+~4.1.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars.runtime",
            "binary_version": "3:4.7.7+~4.1.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-handlebars",
        "purl": "pkg:deb/ubuntu/node-handlebars@3:4.7.7+~4.1.0-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:4.7.7+~4.1.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars.runtime",
            "binary_version": "3:4.7.7+~4.1.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "node-handlebars",
        "purl": "pkg:deb/ubuntu/node-handlebars@3:4.7.7+~4.1.0-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:4.7.7+~4.1.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars",
            "binary_version": "3:4.7.7+~4.1.0-1"
          },
          {
            "binary_name": "libjs-handlebars.runtime",
            "binary_version": "3:4.7.7+~4.1.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-handlebars",
        "purl": "pkg:deb/ubuntu/node-handlebars@3:4.7.7+~4.1.0-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3:4.7.7+~4.1.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{\u003e @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require(\u0027handlebars/runtime\u0027)`). The `compile()` method is  absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers  should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in contexts where templates or context data can be influenced by untrusted input.",
  "id": "UBUNTU-CVE-2026-33938",
  "modified": "2026-06-30T16:20:55Z",
  "published": "2026-03-27T21:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-33938"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33938"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-33938"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.