Access of Resource Using Incompatible Type ('Type Confusion')

🗓️ 27 Mar 2026 18:19:58Reported by Snyk Security DatabaseType

Handlebars type confusion in compile enables remote code execution from a crafted AST; upgrade to 4.7.9.

Reporter	Title	Published	Views	Family All 65
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941) and denial of service (CVE-2026-33939)	7 May 202613:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	24 Apr 202617:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	24 Apr 202614:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Handlebars	5 May 202609:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Handlebars, Apache MINA and Apache Tomcat might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
ATTACKERKB	CVE-2026-33937	27 Mar 202621:03	–	attackerkb
Information Security Automation	April Linux Patch Wednesday	22 Apr 202616:00	–	avleonov
GithubExploit	Exploit for Type Confusion in Handlebarsjs Handlebars	22 Apr 202605:09	–	githubexploit
Chainguard	CVE-2026-33937 vulnerabilities	30 Mar 202619:17	–	cgr
Circl	CVE-2026-33937	27 Mar 202618:19	–	circl

Vulners

Node

Source	Link
cwe	www.cwe.mitre.org/data/definitions/CWE-94.html
cwe	www.cwe.mitre.org/data/definitions/CWE-843.html
cwe	www.cwe.mitre.org/data/definitions/CWE-1321.html
security	www.security.snyk.io/vuln/SNYK-JS-HANDLEBARS-15803084

29 Mar 2026 09:39Current

6.2Medium risk

Vulners AI Score6.2

CVSS 49.3

CVSS 3.19.8

EPSS0.01739

SSVC