A vulnerability, classified as problematic, has been found in Handlebars up to 4.7.8. The affected element is an unknown function in the library lib/precompiler.js. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-2026-33941. The attack can only be executed locally. It is advisable to upgrade the affected component.
| Vendor | Product | Versions |
|---|---|---|
| handlebars-lang | handlebars.js | npm/handlebars: >= 4.0.0, <= 4.7.8 |
Updated description with new details about the vulnerability and clarified that there is no exploit available.
Initial creation
