vulnerability · Thu 08 Oct 2026 · 17:52 UTC
GHSA-8r5x-fm3f-whwj: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
Filed UTCSource GTH ↗
Handlebars.compile() and Handlebars.precompile() accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked. If an application passes an untrusted object to compile() or precompile(), such as a parsed JSON request body, that object can carry arbitrary JavaScript. With compile(), the code runs on the server when the template renders. …
Signals
as the pipeline stamped them- High
- Critical vulnerability — CVSS 9.8
- What to do
- Critical severity — schedule an urgent patch.
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-106446 | — | 0.64% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.