CVE-2026-33941

🗓️ 27 Mar 2026 22:16:21Reported by [email protected]Type

CVE-2026-33941: Handlebars precompiler for versions 4.0.0–4.7.8 concatenates user input, enabling arbitrary JavaScript.

Reporter	Title	Published	Views	Family All 63
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941) and denial of service (CVE-2026-33939)	7 May 202613:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to Handlebars (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)	21 Aug 202612:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	24 Apr 202617:45	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Improper Check for Unusual or Exceptional Conditions, Cross-site Scripting (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)	3 Sep 202618:58	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Handlebars	5 May 202609:18	–	ibm
ATTACKERKB	CVE-2026-33941	27 Mar 202621:13	–	attackerkb
BDU FSTEC	The vulnerability of the lib/precompiler.js component, a tool for creating Handlebars templates, allows a hacker to cause a service failure.	7 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33941 vulnerabilities	30 Mar 202619:17	–	cgr
Circl	CVE-2026-33941	26 Mar 202621:00	–	circl
CNNVD	Handlebars.js 安全漏洞	27 Mar 202600:00	–	cnnvd

NVD

Node

handlebarsjs handlebarsRange4.0.0–4.7.9node.js

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
github	www.github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xjpj-3mr7-gcpf
github	www.github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33941.json
access	www.access.redhat.com/errata/RHSA-2026:10175
access	www.access.redhat.com/errata/RHSA-2026:34342
access	www.access.redhat.com/security/cve/CVE-2026-33941

04 Sep 2026 13:19Current

CVSS 3.18.2

EPSS0.00291

Handlebars precompiler arbitrary JavaScript input validation sandboxing trusted namespace