Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Description

Handlebars.compile() and Handlebars.precompile() accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked.

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, <= 4.7.9
• Patched version(s): 4.7.10

References

• GHSA-8r5x-fm3f-whwj
• CVE-2026-106446
• CWE-843
• CWE-94
• CAPEC-310