Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

{
  "id": "65027b32c9f5c1f6afa0d8de118b4c6bc916a32dca806ee68d04f1f473656362",
  "url": "https://osv.dev/vulnerability/GHSA-8r5x-fm3f-whwj",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)",
    "summary": "## Summary `Handlebars.compile()` and `Handlebars.precompile()` accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on `PathExpression`, `NumberLiteral` and `BooleanLiteral` nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked. If an application passes an untrusted object to `compile()` or `precompile()`, such as a parsed JSON request body, that object can carry arbitrary JavaScript. With `compile()`, the code runs on the server when the template renders. With `precompile()`, it ends up in the precompiled output and runs wherever that output is loaded. Applications that only ever pass template **strings** are not affected. This bypasses the AST validation added in 4.7.9 for GHSA-2w6w-674q-4c4q, GHSA-xhpv-hc6g-r9c6 and GHSA-3mfm-83xf-c92r. ## Details The 4.7.9 validator runs in `parseWithoutProcessing()` and walks the whole AST. It only checks values on nodes whose `type` is `PathExpression`, `NumberLiteral` or `BooleanLiteral`. It passes over plain objects without a `type`, and over strings and other non-object values. The compiler reads these values from other places and writes them into the generated code as-is: | AST value | Written into generated code as | Compile options needed | | --- | --- | --- | | `Program.blockParams.length` | `container.program(, data, )` | none (default options) | | `depth` on a param that is not a `PathExpression`, e.g. a `Str",
    "evidence": "osv:GHSA-8r5x-fm3f-whwj",
    "products": [
      {
        "name": {
          "value": "handlebars",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.7.10",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "GHSA-8r5x-fm3f-whwj",
      "aliases": [
        "CVE-2026-106446",
        "GHSA-8r5x-fm3f-whwj"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "4.0.0"
                },
                {
                  "fixed": "4.7.10"
                }
              ]
            }
          ],
          "package": {
            "name": "handlebars",
            "purl": "pkg:npm/handlebars",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-8r5x-fm3f-whwj/GHSA-8r5x-fm3f-whwj.json",
            "last_known_affected_version_range": "<= 4.7.9"
          }
        }
      ],
      "modified": "2026-10-08T18:00:08.902906060Z",
      "provider": "osv",
      "references": [
        "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-106446",
        "https://github.com/handlebars-lang/handlebars.js/pull/2185",
        "https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2",
        "https://github.com/handlebars-lang/handlebars.js",
        "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-843",
          "CWE-94"
        ],
        "severity": "CRITICAL",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-06T20:17:26Z",
        "github_reviewed_at": "2026-10-08T17:52:32Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-106446",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 104432,
  "published_at": "2026-10-08T17:52:32+00:00"
}