A vulnerability has been found in Handlebars up to 4.7.8 and classified as critical. Affected by this vulnerability is the function compile. The manipulation leads to code injection. This vulnerability is referenced as CVE-2026-33938. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.
| Vendor | Product | Versions |
|---|---|---|
| handlebars-lang | handlebars.js | >= 4.0.0, < 4.7.9 |
Updated description with new details about the vulnerability and corrected exploit availability to false.
Updated severity to CRITICAL, marked as actively exploited, and noted that no specific patch version is provided.
Initial creation
