The vulnerability of the `resolvePartial()` and `invokePartial()` functions in the `lib/handlebars/runtime.js` component, a tool for creating Handlebars templates, allows a malicious actor to cause a service failure.

🗓️ 07 Jul 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 15 Views

Improper code generation in lib/handlebars/runtime.js risks service failure.

Reporter	Title	Published	Views	Family All 184
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941) and denial of service (CVE-2026-33939)	7 May 202613:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Handlebars (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)	21 Aug 202612:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	24 Apr 202617:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	24 Apr 202614:07	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Improper Check for Unusual or Exceptional Conditions, Cross-site Scripting (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)	3 Sep 202618:58	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Handlebars	5 May 202609:18	–	ibm
ATTACKERKB	CVE-2026-33940	27 Mar 202621:11	–	attackerkb
Information Security Automation	April Linux Patch Wednesday	22 Apr 202616:00	–	avleonov
Chainguard	CVE-2026-33940 vulnerabilities	30 Mar 202619:17	–	cgr
Circl	CVE-2026-33940	26 Mar 202620:59	–	circl

Vulners

Node

OR

red_hat,openshift_dev_spacesMatch3.27

yehuda_katz handlebarsRange4.0.0–4.7.9

red_hat,red_hat_enterprise_linuxMatch8

red_hat,red_hat_enterprise_linuxMatch9

red_hat,red_hat_enterprise_linuxMatch10

Source	Link
github	www.github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
github	www.github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
github	www.github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xhpv-hc6g-r9c6
lk	www.lk.astralinux.ru/
access	www.access.redhat.com/security/cve/cve-2026-33940
web	www.web.nvd.nist.gov/view/vuln/detail

07 Jul 2026 00:00Current

6Medium risk

Vulners AI Score6

CVSS 27.6

CVSS 38.1

EPSS0.00703

resolve partial invoke partial handlebars runtime code generation service failure