Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Description

A crafted object placed in the template context can bypass all conditional guards in resolvePartial() and cause invokePartial() to return undefined. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to env.compile().

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, <= 4.7.8
• Patched version(s): 4.7.9

References

• GHSA-xhpv-hc6g-r9c6
• CVE-2026-33940
• CWE-843
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block - CVE-2026-33938
• Handlebars.js has JavaScript Injection via AST Type Confusion - CVE-2026-33937
• Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options - CVE-2026-33941
• js-toml has silent type confusion via falsy-primitive duplicate-key bypass - CVE-2026-50029

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

How do hackers hack websites?

Tags:

npm

handlebars