{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/handlebarsjs/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-33937"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-C0GNIT00-CVE-2026-33937\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["handlebars","rce","ast-injection","javascript"],"_cs_type":"advisory","_cs_vendors":["Handlebarsjs"],"content_html":"\u003cp\u003eHandlebars.js is vulnerable to remote code execution (RCE) due to insufficient sanitization when handling Abstract Syntax Trees (ASTs). Specifically, the \u003ccode\u003eHandlebars.compile()\u003c/code\u003e function in versions 4.0.0 through 4.7.8 directly emits the \u003ccode\u003evalue\u003c/code\u003e field of a \u003ccode\u003eNumberLiteral\u003c/code\u003e AST node into the generated JavaScript without proper escaping or sanitization. This allows an attacker who can control the input to \u003ccode\u003eHandlebars.compile()\u003c/code\u003e to inject arbitrary JavaScript code, leading to RCE on the server. The vulnerability, identified as CVE-2026-33937, arises when \u003ccode\u003eHandlebars.compile()\u003c/code\u003e receives a pre-parsed AST object instead of a template string. This is particularly dangerous in scenarios where user-supplied JSON is deserialized and directly passed to \u003ccode\u003eHandlebars.compile()\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a server-side application that uses Handlebars.js for templating and deserializes JSON from user input, such as an Express application using \u003ccode\u003eexpress.json()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious JSON payload containing a \u003ccode\u003eNumberLiteral\u003c/code\u003e AST node with a \u003ccode\u003evalue\u003c/code\u003e field designed to execute arbitrary JavaScript.\u003c/li\u003e\n\u003cli\u003eThe malicious JSON payload is sent to an endpoint that passes the deserialized JSON directly to \u003ccode\u003eHandlebars.compile()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eHandlebars.compile()\u003c/code\u003e processes the AST and, due to the vulnerability, includes the attacker-controlled \u003ccode\u003evalue\u003c/code\u003e from the \u003ccode\u003eNumberLiteral\u003c/code\u003e node verbatim into the generated JavaScript code.\u003c/li\u003e\n\u003cli\u003eThe generated JavaScript code is then evaluated, typically using \u003ccode\u003eeval()\u003c/code\u003e or a similar function.\u003c/li\u003e\n\u003cli\u003eThe injected JavaScript code executes arbitrary commands on the server, such as using \u003ccode\u003eprocess.getBuiltinModule('child_process').execFileSync()\u003c/code\u003e to run system commands.\u003c/li\u003e\n\u003cli\u003eThe output of the executed commands is returned to the attacker, confirming successful RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code on the server hosting the vulnerable Handlebars.js application. This can lead to complete compromise of the server, including data theft, system takeover, and denial of service. The vulnerability affects applications using Handlebars.js versions 4.0.0 through 4.7.8. The provided proof-of-concept demonstrates the execution of the \u003ccode\u003eid\u003c/code\u003e command, highlighting the potential for more severe attacks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement input validation to ensure that the argument passed to \u003ccode\u003eHandlebars.compile()\u003c/code\u003e is always a string and not a JSON-deserialized object, as demonstrated in the workaround example.\u003c/li\u003e\n\u003cli\u003eApply the workaround of using the Handlebars runtime-only build (\u003ccode\u003ehandlebars/runtime\u003c/code\u003e) on the server if templates are pre-compiled at build time to remove the \u003ccode\u003ecompile()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eUpgrade Handlebars.js to a version outside the vulnerable range (\u0026gt;= 4.0.0, \u0026lt;= 4.7.8) to patch CVE-2026-33937.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-07T21:43:41Z","date_published":"2024-01-16T14:30:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-16-handlebars-rce/","summary":"Handlebars.js versions 4.0.0 through 4.7.8 are vulnerable to remote code execution via a crafted AST that injects arbitrary JavaScript through the `Handlebars.compile()` function.","title":"Handlebars.js Remote Code Execution via AST Injection","url":"https://feed.craftedsignal.io/briefs/2024-01-16-handlebars-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Handlebarsjs","version":"https://jsonfeed.org/version/1.1"}