CVE-2026-33916

🗓️ 27 Mar 2026 21:00:48Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 152 Views

CVE-2026-33916: Handlebars.js prototype pollution enables XSS via partial template injection; fixed in 4.7.9.

Reporter	Title	Published	Views	Family All 191
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	24 Apr 202617:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	29 Apr 202613:24	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Cross-site Scripting (CVE-2026-33916)	3 Sep 202619:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	24 Apr 202614:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Bob	26 May 202614:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Handlebars, Apache MINA and Apache Tomcat might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in Handlebars	25 Jun 202610:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere eXtreme Scale is affected by multiple CVEs	7 Aug 202611:38	–	ibm
ATTACKERKB	CVE-2026-33916	27 Mar 202621:00	–	attackerkb
BDU FSTEC	The vulnerability of the resolvePartial() function in the lib/handlebars/runtime.js component, a tool for creating Handlebars templates, allows attackers to access confidential data and compromise its integrity.	8 Jul 202600:00	–	bdu_fstec

NVD

Vulners

Node

handlebarsjs handlebarsRange4.0.0–4.7.9node.js

[
  {
    "vendor": "handlebars-lang",
    "product": "handlebars.js",
    "versions": [
      {
        "version": ">= 4.0.0, < 4.7.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
github	www.github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
github	www.github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9

17 Jun 2026 10:38Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.7

EPSS0.00276

SSVC