Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-33937: Handlebars templates may allow unauthorized code execution
CVE-2026-33937 · published today
Summary
The Handlebars library used in several packages can be tricked into running unwanted code. This affects the listed Handlebars implementations and could let attackers affect your applications. Update to the latest patched versions provided by the maintainers to protect your systems.
What to do
- Update jaylinski handlebars to version 4.7.9.
- Update rootio @rootio/handlebars to version 4.7.8-root.io.4.
- Update rootio @rootio/handlebars to version 4.7.8-root.io.5.
- Update rootio @rootio/handlebars to version 4.7.7-root.io.1.
- Update rootio @rootio/handlebars to version 4.7.8-root.io.6.
- Update jaylinski handlebars to version 4.7.8-aikido.6.
- Update jaylinski handlebars to version 4.7.7-aikido.3.
- Update rootio @rootio/handlebars to version 4.7.7-root.io.3.
- Update handlebars to version 4.7.7-aikido.5.
- Update rootio @rootio/handlebars to version 4.7.7-root.io.5.
- Update handlebarsjs handlebars to version 4.7.9 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | jaylinski | handlebars |
>= 4.0.0, <= 4.7.8 Fix: upgrade to 4.7.9
|
| Debian:11 | debian | node-handlebars | All versions |
| Debian:12 | debian | node-handlebars | All versions |
| Debian:13 | debian | node-handlebars | All versions |
| Debian:14 | debian | node-handlebars | All versions |
| – | handlebarsjs | handlebars |
>= 4.0.0, < 4.7.9 cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* |
| Root:npm | rootio | @rootio/handlebars |
< 4.7.8-root.io.4 < 4.7.8-root.io.5 < 4.7.7-root.io.1 < 4.7.8-root.io.6 < 4.7.7-root.io.3 < 4.7.7-root.io.5 Fix: upgrade to 4.7.8-root.io.4
|
| Root:npm | jaylinski | handlebars |
< 4.7.8-aikido.6 < 4.7.7-aikido.3 Fix: upgrade to 4.7.8-aikido.6
|
| – | handlebars-lang | handlebars.js | >= 4.0.0, < 4.7.9 |
| Root:npm | – | handlebars |
< 4.7.7-aikido.5 Fix: upgrade to 4.7.7-aikido.5
|
Original advisory text
CVE-2026-33937 in handlebars - Patched by Root
Root has patched CVE-2026-33937 in the handlebars package for Root:npm. Multiple fixed versions available.
References
- https://security-tracker.debian.org/tracker/CVE-2026-33937 Vendor Advisory
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2w6w-6... Exploit Vendor Advisory
- https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c... Patch
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 Release Notes
- https://github.com/advisories/GHSA-2w6w-674q-4c4q
- https://nvd.nist.gov/vuln/detail/CVE-2026-33937
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/security/cve/CVE-2026-33937
- https://bugzilla.redhat.com/show_bug.cgi?id=2452523
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33937.json
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-94Code Injection
CWE-843Type Confusion
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen27 Mar 2026
Sources
GHSA-2w6w-674q-4c4q · GHSA
CVE-2026-33937 · NVD
DEBIAN-CVE-2026-33937 · OSV
CVE-2026-33937 · MITRE
Track software like this
Free during beta