8.2
HIGH
CVSS 3.1
CVE-2026-33941
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Overview
Description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (`"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated build pipeline.
Details
INFO
Published Date :
March 27, 2026, 10:16 p.m.
Last Modified :
Oct. 26, 2026, 10:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
Solution
Update Handlebars to 4.7.9 to fix arbitrary JavaScript injection vulnerability.
- Update Handlebars to version 4.7.9.
- Validate CLI inputs before precompiling templates.
- Use a trusted namespace string from a config file.
- Run precompiler in a sandboxed environment.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-33941.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-33941 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-33941
weaknesses.
CAPEC-63: Cross-Site Scripting (XSS) Cross-Site Scripting (XSS)
CAPEC-85: AJAX Footprinting AJAX Footprinting
CAPEC-209: XSS Using MIME Type Mismatch XSS Using MIME Type Mismatch
CAPEC-588: DOM-Based XSS DOM-Based XSS
CAPEC-591: Reflected XSS Reflected XSS
CAPEC-592: Stored XSS Stored XSS
CAPEC-35: Leverage Executable Code in Non-Executable Files Leverage Executable Code in Non-Executable Files
CAPEC-77: Manipulating User-Controlled Variables Manipulating User-Controlled Variables
CAPEC-242: Code Injection Code Injection
CAPEC-73: User-Controlled Filename User-Controlled Filename
CAPEC-81: Web Server Logs Tampering Web Server Logs Tampering
CAPEC-85: AJAX Footprinting AJAX Footprinting
CAPEC-104: Cross Zone Scripting Cross Zone Scripting
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-33941 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-33941 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: handlebars.js de handlebars-lang, Description: Handlebars proporciona la potencia necesaria para permitir a los usuarios construir plantillas semánticas. En las versiones 4.0.0 a 4.7.8, el precompilador CLI de Handlebars (bin/handlebars / lib/precompiler.js) concatena cadenas controladas por el usuario - nombres de archivos de plantilla y varias opciones CLI - directamente en el JavaScript que emite, sin ningún escape o saneamiento. Un atacante que puede influir en los nombres de archivo de plantilla o los argumentos CLI puede inyectar JavaScript arbitrario que se ejecuta cuando el paquete generado se carga en Node.js o un navegador. La versión 4.7.9 corrige el problema. Algunas soluciones alternativas están disponibles. Primero, valide todas las entradas CLI antes de invocar el precompilador. Rechace los nombres de archivo y los valores de opción que contengan caracteres con significado de escape de cadena de JavaScript (”, ’, ;, etc.). Segundo, utilice una cadena de espacio de nombres fija y de confianza pasada a través de un archivo de configuración en lugar de argumentos de línea de comandos en pipelines automatizados. Tercero, ejecute el precompilador en un entorno aislado (contenedor sin acceso de escritura a rutas sensibles) para limitar el impacto de una explotación exitosa. Cuarto, audite los nombres de archivo de plantilla en cualquier repositorio o paquete que sea consumido por un pipeline de compilación automatizado. -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Sep. 04, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/33xxx/CVE-2026-33941.json">CVE-2026-33941</a> -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Sep. 01, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/33xxx/CVE-2026-33941.json">CVE-2026-33941</a> Added Reference https://access.redhat.com/errata/RHSA-2026:10175 Added Reference https://access.redhat.com/errata/RHSA-2026:34342 Added Reference https://access.redhat.com/security/cve/CVE-2026-33941 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2452524 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json Removed Reference https://access.redhat.com/errata/RHSA-2026:10175 Removed Reference https://access.redhat.com/errata/RHSA-2026:34342 Removed Reference https://access.redhat.com/security/cve/CVE-2026-33941 Removed Reference https://bugzilla.redhat.com/show_bug.cgi?id=2452524 Removed Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json -
CVE Modified by [email protected]
Sep. 01, 2026
Action Type Old Value New Value Added Reference https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 Added Reference https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 Added Reference https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf Removed Reference https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 Removed Reference https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 Removed Reference https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf Removed Reference Type https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 Types: Patch Removed Reference Type https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 Types: Release Notes Removed Reference Type https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf Types: Exploit, Vendor Advisory -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/a:redhat:cluster_observability_operator:1.5::el9'], 'vendor': 'Red Hat', 'product': 'Cluster Observability Operator 1.5.0', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:cryostat:4'], 'vendor': 'Red Hat', 'product': 'Cryostat 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_data_grid:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Data Grid 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_bpms_platform:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Process Automation 7', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:cluster_observability_operator:1.5::el9'], 'vendor': 'Red Hat', 'product': 'Cluster Observability Operator 1.5.0', 'versions': [{'status': 'unaffected', 'version': '1782839279', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'cluster-observability-operator/logging-console-plugin-pf4-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:cluster_observability_operator:1.5::el9'], 'vendor': 'Red Hat', 'product': 'Cluster Observability Operator 1.5.0', 'versions': [{'status': 'unaffected', 'version': '1782840539', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'cluster-observability-operator/logging-console-plugin-pf5-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:cluster_observability_operator:1.5::el9'], 'vendor': 'Red Hat', 'product': 'Cluster Observability Operator 1.5.0', 'versions': [{'status': 'unaffected', 'version': '1782839996', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'versions': [{'status': 'unaffected', 'version': '1776744110', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'devspaces/code-rhel9', 'collectionURL': 'https://catalog.redhat.com/software/containers/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:cryostat:4'], 'vendor': 'Red Hat', 'product': 'Cryostat 4', 'packageName': 'handlebars', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'packageName': 'openshift-logging/elasticsearch6-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'packageName': 'openshift-logging/elasticsearch-operator-bundle', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'packageName': 'openshift-logging/elasticsearch-proxy-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'packageName': 'openshift-logging/elasticsearch-rhel9-operator', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'packageName': 'openshift-logging/kibana6-rhel8', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'packageName': 'openshift-logging/logging-curator5-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:jboss_data_grid:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Data Grid 8', 'packageName': 'handlebars', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'packageName': 'firefox', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'packageName': 'thunderbird', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'firefox', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': '389-ds:1.4/389-ds-base', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'firefox', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'grafana', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'mozjs60', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'thunderbird', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'firefox', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'packageName': 'thunderbird', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'packageName': 'rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_bpms_platform:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Process Automation 7', 'packageName': 'handlebars', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 02, 2026
Action Type Old Value New Value Added Reference https://access.redhat.com/errata/RHSA-2026:34342 Changed Affected [{'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:cryostat:4'], 'vendor': 'Red Hat', 'product': 'Cryostat 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_data_grid:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Data Grid 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_bpms_platform:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Process Automation 7', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:cluster_observability_operator:1.5::el9'], 'vendor': 'Red Hat', 'product': 'Cluster Observability Operator 1.5.0', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:cryostat:4'], 'vendor': 'Red Hat', 'product': 'Cryostat 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_data_grid:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Data Grid 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_bpms_platform:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Process Automation 7', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/a:redhat:openshift_devspaces:3.27::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Dev Spaces 3.27', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:logging:5'], 'vendor': 'Red Hat', 'product': 'Logging Subsystem for Red Hat OpenShift', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:cryostat:4'], 'vendor': 'Red Hat', 'product': 'Cryostat 4', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_data_grid:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Data Grid 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift_ai'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift AI (RHOAI)', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:jboss_enterprise_bpms_platform:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Process Automation 7', 'defaultStatus': 'unaffected'}] Added CVSS V3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Added CWE CWE-94 Added Reference https://access.redhat.com/errata/RHSA-2026:10175 Added Reference https://access.redhat.com/security/cve/CVE-2026-33941 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2452524 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-33941', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-03-31T00:00:00+00:00'} -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'handlebars-lang', 'product': 'handlebars.js', 'versions': [{'status': 'affected', 'version': '>= 4.0.0, < 4.7.9'}]}] -
Initial Analysis by [email protected]
Mar. 31, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* versions from (including) 4.0.0 up to (excluding) 4.7.9 Added Reference Type GitHub, Inc.: https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 Types: Release Notes Added Reference Type GitHub, Inc.: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf Types: Exploit, Vendor Advisory -
New CVE Received by [email protected]
Mar. 27, 2026
Action Type Old Value New Value Added Description Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser. Version 4.7.9 fixes the issue. Some workarounds are available. First, validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (`"`, `'`, `;`, etc.). Second, use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines. Third, run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation. Fourth, audit template filenames in any repository or package that is consumed by an automated build pipeline. Added CVSS V3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Added CWE CWE-79 Added CWE CWE-94 Added CWE CWE-116 Added Reference https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 Added Reference https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 Added Reference https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.