Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Description

The @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects.

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, <= 4.7.8
• Patched version(s): 4.7.9

References

• GHSA-3mfm-83xf-c92r
• CVE-2026-33938
• CWE-843
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - CVE-2026-33940
• Handlebars.js has JavaScript Injection via AST Type Confusion - CVE-2026-33937
• Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - CVE-2026-33941
• Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection - CVE-2026-33916

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

How do hackers hack websites?

Tags:

npm

handlebars