PT-2026-28569 · Unknown · Handlebars
Realhurrison
·
Published
2026-03-27
·
Updated
2026-05-19
·
CVE-2026-33937
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Handlebars versions 4.0.0 through 4.7.8
Description
Handlebars allows Remote Code Execution (RCE) through a crafted Abstract Syntax Tree (AST) object. The
Handlebars.compile() function accepts either a template string or a pre-parsed AST. When an AST is supplied, the value field of a NumberLiteral AST node is emitted directly into the generated JavaScript without proper sanitization. This allows an attacker who can supply a crafted AST to compile() to inject and execute arbitrary JavaScript code on the server. The vulnerable code path resides in lib/handlebars/compiler/javascript-compiler.js, where NumberLiteral values are appended to the generated code without escaping. Any endpoint that deserializes user-controlled JSON and passes the result directly to Handlebars.compile() is potentially exploitable. An attacker can leverage this to execute commands on the server, as demonstrated by a proof of concept that uses process.getBuiltinModule('child process').execFileSync('id') to execute the 'id' command.Recommendations
Handlebars versions prior to 4.7.9 are affected.
Validate input type before calling
Handlebars.compile(): ensure the argument is always a string, never a plain object or JSON-deserialized value.
Use the Handlebars runtime-only build (handlebars/runtime) on the server if templates are pre-compiled at build time; compile() will be unavailable.Exploit
Fix
RCE
DoS
Type Confusion
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Handlebars