CVE-2026-33937

🗓️ 27 Mar 2026 21:03:46Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 383 Views🌐 WEB

CVE-2026-33937: Handlebars.js AST in compile enables JavaScript injection; fixed in 4.7.9.

Reporter	Title	Published	Views	Family All 75
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941) and denial of service (CVE-2026-33939)	7 May 202613:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	24 Apr 202617:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	24 Apr 202614:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Handlebars	5 May 202609:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Handlebars, Apache MINA and Apache Tomcat might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere eXtreme Scale is affected by multiple CVEs	7 Aug 202611:38	–	ibm
GithubExploit	Exploit for Type Confusion in Handlebarsjs Handlebars	3 Aug 202606:27	–	githubexploit
GithubExploit	Exploit for Type Confusion in Handlebarsjs Handlebars	30 Jul 202620:23	–	githubexploit
GithubExploit	Exploit for Type Confusion in Handlebarsjs Handlebars	22 Apr 202605:09	–	githubexploit
ATTACKERKB	CVE-2026-33937	27 Mar 202621:03	–	attackerkb

NVD

Vulners

Node

handlebarsjs handlebarsRange4.0.0–4.7.9node.js

[
  {
    "vendor": "handlebars-lang",
    "product": "handlebars.js",
    "versions": [
      {
        "version": ">= 4.0.0, < 4.7.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q
github	www.github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
github	www.github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33937.json
access	www.access.redhat.com/security/cve/CVE-2026-33937
access	www.access.redhat.com/errata/RHSA-2026:34342
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/errata/RHSA-2026:10175

Parameter	Position	Path	Description	CWE
campaign_message	request body	/character	Handlebars.compile() called with a crafted AST in campaign_message leading to remote code execution.	CWE-94, CWE-843
campaign_id	request body	/character	Handlebars.compile() called with a crafted AST in campaign_message leading to remote code execution.	CWE-94, CWE-843

15 Jul 2026 02:20Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.19.8

EPSS0.02254

SSVC