CVE-2026-33916: medium-severity vulnerability in handlebars-lang handlebars.js
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.3%
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
handlebars-lang · handlebars.jsRelated CVEs — handlebars-lang handlebars.js
In the same product, most dangerous first.
CVE-2026-33937CRITICALHandlebars.js has JavaScript Injection via AST Type ConfusionEPSS 1.9%CVE-2026-106446CRITICALHandlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)EPSS 0.8%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.7%CVE-2026-33940HIGHHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialEPSS 0.7%CVE-2026-33939HIGHHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationEPSS 0.6%CVE-2026-106445CRITICALHandlebars: JavaScript Injection via Own Property Check BypassEPSS 0.6%