Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-x839-p6g2-f3ca
Vulnerability ID VCID-x839-p6g2-f3ca
Aliases CVE-2026-33916
GHSA-2qvq-rjwj-gvw9
Summary Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33916.json
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-33916
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-33916
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-33916
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-33916
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2qvq-rjwj-gvw9
cvssv3.1 4.7 https://github.com/handlebars-lang/handlebars.js
generic_textual MODERATE https://github.com/handlebars-lang/handlebars.js
cvssv3.1 4.7 https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
generic_textual MODERATE https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
ssvc Track https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
cvssv3.1 4.7 https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
generic_textual MODERATE https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
ssvc Track https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
cvssv3.1 4.7 https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
cvssv3.1_qr MODERATE https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
generic_textual MODERATE https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
ssvc Track https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
cvssv3.1 4.7 https://nvd.nist.gov/vuln/detail/CVE-2021-23369
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-23369
cvssv3.1 4.7 https://nvd.nist.gov/vuln/detail/CVE-2021-23383
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-23383
cvssv3.1 4.7 https://nvd.nist.gov/vuln/detail/CVE-2026-33916
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-33916
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33916.json
https://api.first.org/data/v1/epss?cve=CVE-2026-33916
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33916
https://github.com/handlebars-lang/handlebars.js
https://nvd.nist.gov/vuln/detail/CVE-2021-23369
https://nvd.nist.gov/vuln/detail/CVE-2026-33916
1132141 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132141
2452509 https://bugzilla.redhat.com/show_bug.cgi?id=2452509
68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
CVE-2021-23383 https://nvd.nist.gov/vuln/detail/CVE-2021-23383
GHSA-2qvq-rjwj-gvw9 https://github.com/advisories/GHSA-2qvq-rjwj-gvw9
GHSA-2qvq-rjwj-gvw9 https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
v4.7.9 https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-33916.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/handlebars-lang/handlebars.js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-30T15:41:27Z/ Found at https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-30T15:41:27Z/ Found at https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-30T15:41:27Z/ Found at https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-23369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-23383
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-33916
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.22025
EPSS Score 0.00072
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:49:46.403564+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/33xxx/CVE-2026-33916.json 38.6.0