CVE-2026-33937: Handlebars.js RCE via AST Injection in Template Compilation

How to check if you are exposed to CVE-2026-33937

1. Identify all projects with Handlebars as a direct or transitive dependency: # (run from the repository root or Node.js project directory) npm ls handlebars 2>/dev/null # or find . -name "package.json" -not -path "*/node_modules/*" \ -exec grep -l '"handlebars"' {} \;
2. Check the installed Handlebars version: cat node_modules/handlebars/package.json | grep '"version"' # Note the version; compare against NVD advisory once authoritative ranges are published
3. Search application code for compile() calls — these are the key risk pattern: grep -rn "Handlebars\.compile\|Handlebars\.precompile" \ --include="*.js" --include="*.ts" --include="*.mjs" \ . | grep -v node_modules # Any call that passes a variable (not a string literal) is potentially exploitable
4. Distinguish safe from unsafe patterns in code review: grep -A2 "Handlebars\.compile" src/ -r --include="*.js" | \ grep -v "require\|import\|//" # Look for: compile(req.body.*), compile(params.*), compile(template), # compile(userInput), compile(config.*template*) — any non-literal argument
5. Check for template endpoints in web application APIs: # Look for route handlers that accept template strings as POST body parameters grep -rn "template\|handlebars\|hbs" routes/ controllers/ api/ \ --include="*.js" --include="*.ts" 2>/dev/null | grep -v node_modules
6. Probe for template compilation endpoints on a running application (authenticated): # If the application has a "preview template" or "render template" feature, # test whether it reflects computed output from arbitrary template input: curl -s -X POST https://<target>/api/templates/preview \ -H "Content-Type: application/json" \ -H "Authorization: Bearer <token>" \ -d '{"template": "{{#with (lookup . \"constructor\")}}{{this.name}}{{/with}}"}' # A response containing "Object" in the output confirms Handlebars compilation # of user input — test further for the CVE-2026-33937 payload impact
7. Search for Handlebars usage in Docker images or deployed Lambda functions: # For containerized environments, extract the package manifest: docker exec <container> cat /app/package.json | grep handlebars docker exec <container> cat /app/node_modules/handlebars/package.json | grep version

Frequently asked questions

What is CVE-2026-33937?

CVE-2026-33937 is a critical remote code execution vulnerability (CVSS 9.8, estimated from vulnerability class) in Handlebars.js, the most widely distributed JavaScript server-side templating library in the Node.js ecosystem. The vulnerability exploits Handlebars' template compilation pipeline: when an application passes user-controlled input to Handlebars.compile() or Handlebars.precompile(), an attacker can supply a crafted template string that injects malicious AST nodes during compilation, breaking out of the library's sandbox protections and executing arbitrary code in the Node.js process. For security teams and CISOs, the business impact is determined by where Handlebars appears in the application stack: any feature that allows users to define, customize, or preview templates — email template editors, dynamic report builders, CMS theme systems, form builders, or API response formatters — is a potential exploitation point. Exposure is not uniform and not always obvious from the dependency tree alone; it requires identifying whether application code compiles user-supplied template strings, not merely whether Handlebars is installed. The vendor has not issued a patch at time of writing; available mitigations are architectural — removing the pattern of compiling user-supplied templates — and should be applied immediately in any affected component.

Is CVE-2026-33937 being actively exploited?

A public proof-of-concept for CVE-2026-33937 was published on GitHub following disclosure. The PoC demonstrates AST injection via a crafted template string that executes arbitrary JavaScript — including process.mainModule.require('child_process').execSync() — within the Handlebars compilation and execution pipeline. The template string itself appears structurally similar to valid Handlebars syntax, which means it is unlikely to be caught by input validation that checks only for obvious code injection markers (angle brackets, script tags, or eval keywords).

Am I exposed to CVE-2026-33937?

Exposure requires two conditions to hold simultaneously: (1) Handlebars.js is a dependency of the application, and (2) the application compiles user-supplied or user-influenced template strings at runtime. The second condition is not detectable from the dependency manifest alone — it requires code inspection.

How do I fix CVE-2026-33937?

No patch exists at time of writing that makes Handlebars.compile() safe to call with untrusted input. The secure architecture is to never compile user-supplied strings; instead, compile only developer-controlled templates and pass user data as the execution context: