CVE-2026-33937

Esta publicación es un artículo de investigación publicado por EQSTLab. PoC de referencia: dinhvaren/cve-2026-33937 CVE-2026-33937 ★ CVE-2026-33937 PoC de inyección de AST y ejecución remota de código en Handlebars.js ★ https://github.com/user-attachments/assets/99e383e7-e71f-4e10-8c62-f50abff8b4...

cve-2026-33937

CVE-2026-33937 - Handlebars RCE エクスプロイト PoC 説明 CVE-2026-33937 は、Handlebars における Abstract Syntax Tree（AST）入力の安全でない処理に起因する、重大なリモートコード実行（RCE）脆弱性です。 この脆弱性により、攻撃者は Handlebars.compile に細工された AST オブジェクトを渡すことで、任意の JavaScript コードを注入できます。 根本原因 Handlebars.compile は以下の両方を受け入れます： テンプレート文字列 事前解析済みの AST オブジェクト...

CVE-2026-33937

CVE-2026-33937 — Handlebars.js AST 인젝션 RCE Handlebars.js 4.0.0부터 4.7.8까지의 버전이 영향을 받습니다. CVSS 점수: 9.8 치명적Critical. 개요 CVE-2026-33937은 Handlebars.js의 타입 혼동type confusion 취약점입니다. Handlebars.compile 함수는 템플릿 문자열과 사전 파싱된 AST 객체를 모두 입력으로 받아들입니다. 공격자가 조작된 AST 객체를 전달하면 컴파일러의 NumberLiteral 방문자가 노드의 value 필...

Exploit for Type Confusion in Handlebarsjs Handlebars

CVE-2026-33937 — Handlebars.js AST Injection RCE Handlebars.j...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.4.1 Vulnerability Details CVEID:CVE-2026-33916 DESCRIPTION: Handlebars provides the power necessary to let users build...

DEBIAN-CVE-2026-33937

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, Handlebars.compile accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the generated JavaScript withou...

CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper...

Handlebars.js has JavaScript Injection via AST Type Confusion

Summary Handlebars.compile accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to compile can therefore inject and...