Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to `compile()` can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling `Handlebars.compile()`; ensure the argument is always a `string`, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (`handlebars/runtime`) on the server if templates are pre-compiled at build time; `compile()` will be unavailable.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-27 | 3 | Disclosure2Patch1 |
| 2026-03-28 | 3 | Disclosure2Patch1 |
| 2026-03-29 | 2 | Disclosure1Patch1 |
| 2026-04-01 | 1 | PoC1 |
| 2026-04-02 | 1 | PoC1 |
| 2026-05-10 | 1 | Patch1 |
| 2026-05-11 | 2 | Disclosure1Patch1 |
| 2026-05-13 | 1 | PoC1 |
| 2026-05-19 | 1 | General1 |
Published yesterday, critical CVE-2026-33937 can lead to remote code execution on servers. All Aikido Zen nodejs users were already protected. https://t.co/vWRm3ncewK
Post summary
The tweet highlights that the critical CVE‑2026‑33937 could enable remote code execution, but Aikido Zen nodejs users have already been protected, implying a patch or workaround was applied prior to publication.
We just launched the first guided lab on CVE Playground. 🔥 CVE-2026-33937 Handlebars.js Template Engine RCE via AST Type Confusion Read the vulnerable code, trace the exploit flow, understand the patch, exploit the target, and submit the flag. https://app.cveplayground.com/labs/CVE-2026-33937?utm_source=x
Post summary
This announcement promotes a guided lab that provides a PoC for CVE‑2026‑33937, detailing an RCE in Handlebars.js and offering users a link to explore the attack flow and patch.
🚨 Handlebars.js JS Injection CVSS: 9.8 Arbitrary code execution via malicious templates in Handlebars engine. Attackers craft payloads exploiting unsafe helpers, leading to full server compromise. https://nvd.nist.gov/vuln/detail/CVE-2026-33937
Post summary
CVE-2026-33937 reveals a high‑severity code execution vulnerability in Handlebars.js that permits full server compromise through malicious templates, though no public PoC, exploitation tools, or active attacks are mentioned.
Handlebars.js tiene dos fallas críticas con PoC público: CVE-2026-106446 (9.8) y CVE-2026-106445 (9.2) permiten correr JavaScript arbitrario en el servidor Node.js. Afectan de la versión 4.0.0 a la 4.7.9 y la 4.7.10 corrige ambas. Supera 172 millones de descargas al mes. CVE-2026-106446: compile() y precompile() aceptan un árbol AST ya parseado, no solo un string. La validación que llegó en 4.7.9 revisa solo algunos nodos, así que un objeto no confiable puede meter JavaScript en el código generado. Disparador típico: pasar un campo del body JSON directo a compile(). Además salta un arreglo anterior (CVE-2026-33937). Si solo pasas strings de plantilla, no te afecta. CVE-2026-106445: la deny list que bloquea propiedades peligrosas se puede saltar y exponer el constructor Function. Aplica si renderizas plantillas controladas por el atacante con allowProtoMethodsByDefault activado. Sin explotación confirmada, pero los advisories (GHSA-p8wg-vrv2-v86f y GHSA-8r5x-fm3f-whwj) y el PoC están a la vista de todos. Acción: subir a 4.7.10, incluidas las dependencias transitivas. Si no puedes ya: nunca allowProtoMethodsByDefault en true con plantillas no confiables, valida que lo que llega a compile() sea string y usa el build runtime-only donde las plantillas se precompilan.
Try our free labs: CVE-2026-44578: Next.js WebSocket Upgrade SSRF via Absolute-Form Request URI CVE-2026-33937: Handlebars.js Template Engine RCE via AST type confusion in compile() CVE-2026-34197: Apache ActiveMQ Jolokia RCE—solved via addNetworkConnector + vm:// transport https://t.co/2E8JuY6xnC
Post summary
The tweet promotes free labs that showcase technical details of three CVEs, includes a link that likely hosts a PoC, and offers a workaround for one vulnerability.
🚨 #Handlebars, a widely used JS templating library, just released two critical #RCE vulnerabilities. CVE-2026-106445 is a bypass of the prototype-access denial for the Function constructor. An attacker can render a template that reaches Function.prototype when allowProtoMethodsByDefault is enabled, allowing the execution of arbitrary #JS on the server. CVE-2026-106446 is a bypass of CVE-2026-33937 by evading prior AST validation, permitting JS expressions in unchecked values like Program.blockParams.length. The compiler emits those values as valid JavaScript, leading to server-side RCE. Be sure to update Handlebars to v4.7.10! More details: https://devhub.checkmarx.com/cve-details/CVE-2026-106445/ https://devhub.checkmarx.com/cve-details/cve-2026-106446/
@DailyDarkWeb 4.7.9 was the March fix for CVE-2026-33937 (9.8), and 106446 bypasses it, so anyone who patched then and stopped is exposed again. 4.7.10 plus strings-only input to compile() is the durable fix.
Handlebars.js just patched two RCE bugs (CVE-2026-106445 / 106446, up to CVSS 9.8), and the PoCs are public. The library gets 172M downloads a month. The trigger is passing untrusted objects, like a field from a JSON request body, into compile(). One of them bypasses the earlier CVE-2026-33937 fix. Bump to 4.7.10. No in-the-wild exploitation reported yet. https://securityonline.info/handlebars-js-vulnerability-rce-poc/
CVE-2026-33937: Handlebars.js RCE via AST Injection in Template Compilation https://pinaka.sh/blog/cve-2026-33937-handlebars-ast-injection-rce #aisecurity #mythos #cybersecurity #cve #technology #india
Post summary
The article announces a new RCE vulnerability (CVE-2026-33937) in Handlebars.js, detailing its method (AST injection) but not providing exploitation code, active attack reports, or patch information.
🚨 CVE-2026-33937 (Handlebars.js <4.7.9): RCE via crafted AST input to compile(). Attacker-controlled JSON → server-side code execution. PoC live on GitHub since Mar 28. Millions of npm apps affected — most devs unaware. Audit & pin to 4.7.9 NOW. #ZeroDay #npm #nodejs
Post summary
CVE-2026-33937 in Handlebars.js enables remote code execution via crafted AST input; a PoC is publicly available on GitHub, and users are urged to upgrade to version 4.7.9 immediately.
BREAKING: Fedora issues Nextcloud 33.0.3 update for critical Handlebars.js RCE and DoS flaws (CVE-2026-33937, -33939, -33940, -33916, -33938) impacting Fedora 42 and 44, urges dnf patching. https://threatcluster.io/cluster/critical-rce-and-dos-vulnerabilities-in-nextcloud-affect-fed-3c638e14
Post summary
Fedora released Nextcloud 33.0.3 updates to fix critical Handlebars.js RCE and DoS flaws (CVE‑2026‑33937, ‑33939, ‑33940, ‑33916, ‑33938) for Fedora 42/44, urging users to apply the patch via dnf.
PoCs like ctzisme/CVE-2026-23744 and dinhvaren/cve-2026-33937 are valuable for understanding exploit vectors. But remember, a PoC for an unauthenticated vulnerability or an RCE via AST injection means immediate, high-priority patching or mitigation.
Post summary
The post references PoCs for CVE‑2026‑23744 and CVE‑2026‑33937, highlights an unauthenticated RCE via AST injection, and stresses the necessity of prompt patching or mitigation.
Meanwhile, PoCs for other CVEs, like ctzisme/CVE-2026-23744 and dinhvaren/cve-2026-33937, are already appearing on GitHub. This rapid weaponization of vulnerabilities underscores the need for proactive patch management and robust vulnerability scanning.
Post summary
The post highlights that proof‑of‑concepts for CVE‑2026‑23744 and CVE‑2026‑33937 have surfaced on GitHub, underscoring rapid weaponization and the urgency of patch management.
`Handlebars.js` has a critical JavaScript Injection vulnerability (CVE-2026-33937) via AST type confusion. Sanitize untrusted input and prepare for patch. #JavaScript #Infosec #SecurityAdvisory https://www.pulsepatch.io/posts/cve-2026-33937-handlebars-javascript-injection
Post summary
The advisory alerts on a critical JavaScript injection flaw in Handlebars.js (CVE‑2026‑33937) caused by AST type confusion, urging users to sanitize untrusted input and prepare for an upcoming patch.
@AikidoSecurity getBuiltinModule('child_process').execFileSync hiding inside a Handlebars template - CVE-2026-33937 is a nasty one. The payload bypasses typical require() restrictions by using the newer getBuiltinModule API. Good catch blocking it at runtime. https://vulntracker.io
Post summary
A new Node.js vulnerability (CVE‑2026‑33937) is disclosed, enabling execution bypass by using getBuiltinModule within a Handlebars template; no patch or active exploitation details are provided.
CVE-2026-33937 Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object… https://www.cve.org/CVERecord?id=CVE-2026-33937
Post summary
The provided text discloses that Handlebars.compile() accepts pre-parsed AST objects, revealing a potential security flaw.
[CVE-2026-33937: CRITICAL] Handlebars before version 4.7.9 allows Remote Code Execution through a crafted AST object. Validate inputs & use version 4.7.9 or workarounds to secure your server.#cve,CVE-2026-33937,#cybersecurity https://cvefind.com/CVE-2026-33937
Post summary
The post announces a critical RCE vulnerability in Handlebars (CVE‑2026‑33937), describing the exploit vector and recommending an upgrade to 4.7.9 or related workarounds to mitigate the risk.
🔴 CVE-2026-33937 - Critical Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a tem... https://www.thehackerwire.com/vulnerability/CVE-2026-33937/ https://t.co/qxP8n9VIRw
Post summary
The post announces CVE-2026-33937 as a critical vulnerability affecting Handlebars 4.0.0‑4.7.8, noting misuse of compile() with pre‑parsed AST objects, but offers no PoC, exploit code, patch, or evidence of active exploitation.
🚨 CVE-2026-33937: Handlebars.js has JavaScript Inj... AST NumberLiteral values get dumped raw into generated JS - perfect for RCE when devs accept JSON input to compile() in... https://zerodaysignal.com/vulnerability/CVE-2026-33937 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2026-33937 reveals a potential RCE in Handlebars.js where raw NumberLiteral values are directly included in generated JavaScript when processing JSON input.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | handlebarsjs | handlebars | - | node.js | - |