{
  "cveId": "CVE-2026-33937",
  "url": "https://patchblox.com/security/cve/CVE-2026-33937",
  "summary": "CVE-2026-33937 is fixed in node-handlebars on 1 platform by DEBIAN-CVE-2026-33937 (version 3:4.7.9-1), released March 27, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "node-handlebars: Handlebars provides the power necessary to let users build semantic templates",
  "description": "Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, \u0060Handlebars.compile()\u0060 accepts a pre-parsed AST object in addition to a template string. The \u0060value\u0060 field of a \u0060NumberLiteral\u0060 AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to \u0060compile()\u0060 can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. Validate input type before calling \u0060Handlebars.compile()\u0060; ensure the argument is always a  \u0060string\u0060, never a plain object or JSON-deserialized value. Use the Handlebars runtime-only build (\u0060handlebars/runtime\u0060) on the server if templates are pre-compiled at build time; \u0060compile()\u0060 will be unavailable.",
  "published": "2026-03-27T21:17:27Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.01907,
  "epssPercentile": 0.79883,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-handlebars",
      "release": "Debian 14",
      "fixedVersion": "3:4.7.9-1",
      "fix": "DEBIAN-CVE-2026-33937",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-33937",
      "released": "2026-03-27T21:17:27Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}