PT-2026-28573 · Unknown · Handlebars
Gyde04
·
Published
2026-03-27
·
Updated
2026-06-04
·
CVE-2026-33941
CVSS v3.1
8.2
High
| Vector | AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Handlebars versions 4.0.0 through 4.7.8
Description
The Handlebars CLI precompiler (
bin/handlebars / lib/precompiler.js) concatenates user-controlled strings – template file names and several CLI options – directly into the JavaScript it emits without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. The issue stems from the interpolation of user-supplied data into JavaScript code without proper sanitization. Four injection points exist: template name, namespace (-n / --namespace), CommonJS path (-c / --commonjs), and AMD path (-h / --handlebarPath). Exploitation can lead to arbitrary code execution. Proof-of-concept exploits demonstrate the ability to create files on disk by injecting code through these vectors.Recommendations
Versions prior to 4.7.9 are affected.
Validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (
", ', ;, etc.).
Use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines.
Run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation.
Audit template filenames in any repository or package that is consumed by an automated build pipeline.Exploit
Fix
Code Injection
Improper Encoding or Escaping of Output
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Handlebars