EUVD-2026-16849
GHSA-3mfm-83xf-c92r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Handlebars template with helper
-
ExploitHelper overwrites @partial-block with AST
-
ExecutionTemplate invokes {{> @partial-block}}
-
ImpactCompiled AST executes arbitrary JavaScript
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Handlebars template that uses helpers accepting arbitrary objects to overwrite @partial-block with crafted AST, then invokes {{> @partial-block}}. Affects server-side Handlebars rendering. Remote unauthenticated attacker must control helper input or template logic. |
| Impact | This represents a high-severity threat with CVSS 8.1 (High complexity network attack requiring no privileges or user interaction, with high confidentiality, integrity, and availability impact). The AC:H (high attack complexity) stems from requiring specific conditions: the full Handlebars build must be in use, vulnerable helpers (like those from handlebars-helpers) must be registered, and the application must allow attacker-controlled template context data. No public exploit identified at time of analysis beyond the proof-of-concept disclosed by the vendor. While CVSS indicates network-accessible remote code execution with no authentication required, real-world exploitability depends heavily on application-specific factors: whether untrusted users control template context data, which helpers are registered, and whether runtime-only builds are used. The attack is not trivially automatable across all Handlebars deployments due to these prerequisites. Organizations using handlebars-helpers or similar third-party helper packages with user-influenced context data should prioritize remediation. The availability of a working POC significantly lowers the barrier to weaponization. |
| Exploit ScenarioDerived | An attacker targets a Node.js web application using Handlebars with the handlebars-helpers package registered. By submitting malicious JSON payload through an API endpoint or form that populates template context, the attacker provides a crafted Handlebars AST object. When the application renders a template containing nested partials with @partial-block references, the malicious payload overwrites @partial-block via the merge helper. Subsequent invocation of {{> @partial-block}} triggers dynamic compilation of the injected AST, executing arbitrary JavaScript code in the Node.js process with full server privileges. A working proof-of-concept demonstrating this attack flow is publicly available, significantly lowering exploitation barriers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Remote code execution in Handlebars templating engine (npm package) allows unauthenticated attackers to execute arbitrary JavaScript on Node.js servers by exploiting the @partial-block mechanism when combined with vulnerable helper functions. The attack overwrites @partial-block with a malicious Handlebars AST that is dynamically compiled and executed during template rendering. A working proof-of-concept exists demonstrating exploitation via the commonly-used handlebars-helpers package. Vendor-released patch is available in Handlebars version 4.7.9.
RemediationAI
Upgrade Handlebars to version 4.7.9 or later, as released by the vendor at https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9. The patch is available via commit 68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 at https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2. For environments where immediate patching is not feasible, use the runtime-only build via require('handlebars/runtime'), which eliminates the compile() method and the vulnerable dynamic compilation code path. Additionally, audit all registered helpers to ensure they treat context data as read-only and do not write arbitrary values to context objects. Remove or carefully vet third-party helper packages like handlebars-helpers in contexts where templates or context data may be influenced by untrusted input. Review application architecture to ensure user-controlled data does not flow into template context objects without sanitization.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Handlebars is a popular JavaScript templating engine for Node.js applications (CPE: pkg:npm/handlebars). This vulnerability exploits CWE-94 (Improper Control of Generation of Code) through a design flaw in how the @partial-block special variable is stored in the mutable template data context. When helpers like 'merge' from handlebars-helpers accept arbitrary objects, they can overwrite @partial-block with an attacker-crafted Abstract Syntax Tree (AST). The invokePartial function subsequently receives this crafted object and, finding it is not a pre-compiled function, falls back to dynamically compiling the payload via env.compile(). This dynamic compilation path executes the injected AST as JavaScript code in the server process. The vulnerability requires the full Handlebars build with compilation capabilities; the runtime-only build lacks the compile() method and is not vulnerable.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (https://github.com/handlebars-lang/handlebars.js).
CVSS VectorVendor: https://github.com/handlebars-lang/handlebars.js
Lifecycle Timeline
2DescriptionCVE.org
Summary
The @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites @partial-block with a crafted Handlebars AST, a subsequent invocation of {{> @partial-block}} compiles and executes that AST, enabling arbitrary JavaScript execution on the server.
Description
Handlebars stores @partial-block in the data frame that is accessible to templates. In nested contexts, a parent frame's @partial-block is reachable as @_parent.partial-block. Because the data frame is a mutable object, any registered helper that accepts an object reference and assigns properties to it can overwrite @partial-block with an attacker-controlled value.
When {{> @partial-block}} is subsequently evaluated, invokePartial receives the crafted object. The runtime, finding an object that is not a compiled function, falls back to dynamically compiling the value via env.compile(). If that value is a well-formed Handlebars AST containing injected code, the injected JavaScript runs in the server process.
The handlebars-helpers npm package (commonly used with Handlebars) includes several helpers such as merge that can be used as the mutation primitive.
Proof of Concept
Tested with Handlebars 4.7.8 and handlebars-helpers:
const Handlebars = require('handlebars');
const merge = require('handlebars-helpers').object().merge;
Handlebars.registerHelper('merge', merge);
const vulnerableTemplate = `
{{#*inline "myPartial"}}
{{>@partial-block}}
{{>@partial-block}}
{{/inline}}
{{#>myPartial}}
{{merge @_parent partial-block=1}}
{{merge @_parent partial-block=payload}}
{{/myPartial}}
`;
const maliciousContext = {
payload: {
type: "Program",
body: [
{
type: "MustacheStatement",
depth: 0,
path: {
type: "PathExpression",
parts: ["pop"],
original: "this.pop",
// Code injected via depth field - breaks out of generated function call
depth: "0])),function () {console.error('VULNERABLE: RCE via @partial-block');}()));//",
},
},
],
},
};
Handlebars.compile(vulnerableTemplate)(maliciousContext);
// Prints: VULNERABLE: RCE via @partial-blockWorkarounds
- Use the runtime-only build (
require('handlebars/runtime')). Thecompile()method is absent, eliminating the vulnerable fallback path. - Audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only.
- Avoid registering helpers from third-party packages (such as
handlebars-helpers) in contexts where templates or context data can be influenced by untrusted input.
Blast Radius
ecosystem impact- 3 npm packages depend on handlebars (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 4.0.0.
Executive ViewAI
The Handlebars templating engine contains a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript on Node.js servers without authentication. Organizations using Handlebars in web applications face direct risk of complete server compromise, data theft, and service disruption. This vulnerability affects any production system relying on the affected npm package versions, making immediate patching a critical priority.
Apply vendor patch. If immediate patching is infeasible: disable dynamic template compilation where possible; restrict template rendering to trusted, pre-compiled templates only; implement network-level restrictions limiting Node.js server exposure to trusted internal networks; deploy Web Application Firewall (WAF) rules to block requests containing Handlebars AST-injection payloads (targeting @partial-block patterns); apply strict Content Security Policy headers to limit execution context. Note: compensating controls are temporary mitigations only; vendor patch must be applied within 7 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond
Exploit-DB