CVE-2026-33937

CVE-2026-33937 — Handlebars.js AST Injection RCE Handlebars.js versions 4.0.0 through 4.7.8 are affected. CVSS score: 9.8 Critical. Overview CVE-2026-33937 is a type confusion vulnerability in Handlebars.js. The Handlebars.compile function accepts both a template string and a pre-parsed AST objec...

CVE-2026-33937

This post is a research article published by EQSTLab. Referenced PoC: dinhvaren/cve-2026-33937 CVE-2026-33937 ★ CVE-2026-33937 Handlebars.js AST Injection Remote Code Execution PoC ★ https://github.com/user-attachments/assets/99e383e7-e71f-4e10-8c62-f50abff8b4f5 Description CVE-2026-33937 :...

cve-2026-33937

CVE-2026-33937 - Handlebars RCE 漏洞利用 PoC 描述 CVE-2026-33937 是 Handlebars 中的一个严重远程代码执行（RCE）漏洞，由对抽象语法树（AST）输入的不安全处理引起。 该漏洞允许攻击者通过向 Handlebars.compile 提供精心构造的 AST 对象来注入任意 JavaScript 代码。 根本原因 Handlebars.compile 接受两种输入： 模板字符串 预解析的 AST 对象 当提供 AST 对象时，解析阶段会被跳过。 在： root@kitploit:...

Exploit for Type Confusion in Handlebarsjs Handlebars

CVE-2026-33937 — Handlebars.js AST Injection RCE Handlebars.j...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.4.1 Vulnerability Details CVEID:CVE-2026-33916 DESCRIPTION: Handlebars provides the power necessary to let users build...

DEBIAN-CVE-2026-33937

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, Handlebars.compile accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the generated JavaScript withou...

CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper...

Handlebars.js has JavaScript Injection via AST Type Confusion

Summary Handlebars.compile accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to compile can therefore inject and...