CVE catalog

CVE-2026-33916

Severity: Medium · CVSS 4.7CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: Mar 27, 2026, 9:00:48 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.28% · Oct 25, 2026

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates and reduces the attack surface.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-handlebars	sid	`3:4.7.10-1`	fixed
Debian	node-handlebars	forky	`3:4.7.10-1`	fixed
Debian	node-handlebars	trixie	`3:4.7.7+~4.1.0-1`	vulnerable
Debian	node-handlebars	bookworm	`3:4.7.7+~4.1.0-1`	vulnerable
Cpe	node-handlebars	Not reported	Not reported	vulnerable
Cpe	handlebars	Not reported	`4.7.9`	fixed
Cpe	handlebars	Not reported	`4.7.9`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-handlebars	source	sid	`3:4.7.9-1`	not yet assigned	Not reported	[1132141]
Debian	node-handlebars	source	forky	`3:4.7.9-1`	not yet assigned	Not reported	[1132141]
Debian	node-handlebars	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1132141]
Debian	node-handlebars	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1132141]
Cpe	handlebars	cpe	Not reported	`4.7.9`	Not reported	Not reported	Not reported
Cpe	handlebars	cpe	Not reported	`4.7.9`	Not reported	NVD-CVE-2026-33916	Not reported

[Debian bug #1132141]

Notes

[trixie] node-handlebars: Minor issue [bookworm] node-handlebars: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[handlebars]Affected
Source package: [node-handlebars]
Details (2)
- 3:4.7.7+~4.1.0-1 · all · bookworm
  Affected
  nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
- 3:4.7.7+~4.1.0-1 · all · bookworm
  Affected
  nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
[libjs-handlebars]Affected
Source package: [node-handlebars]
Details (2)
- 3:4.7.7+~4.1.0-1 · all · bookworm
  Affected
  nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
- 3:4.7.7+~4.1.0-1 · all · bookworm
  Affected
  nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
[libjs-handlebars.runtime]Affected
Source package: [node-handlebars]
Details (2)
- 3:4.7.7+~4.1.0-1 · all · bookworm
  Affected
  nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
- 3:4.7.7+~4.1.0-1 · all · bookworm
  Affected
  nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12

[Debian 13 (Trixie)]

[handlebars]Affected
Source package: [node-handlebars]
Details (2)
- 3:4.7.7+~4.1.0-1 · all · trixie
  Affected
  nvd · node-handlebars · debian · 13
- 3:4.7.7+~4.1.0-1 · all · trixie
  Affected
  nvd · node-handlebars · debian · 13
[libjs-handlebars]Affected
Source package: [node-handlebars]
Details (2)
- 3:4.7.7+~4.1.0-1 · all · trixie
  Affected
  nvd · node-handlebars · debian · 13
- 3:4.7.7+~4.1.0-1 · all · trixie
  Affected
  nvd · node-handlebars · debian · 13
[libjs-handlebars.runtime]Affected
Source package: [node-handlebars]
Details (2)
- 3:4.7.7+~4.1.0-1 · all · trixie
  Affected
  nvd · node-handlebars · debian · 13
- 3:4.7.7+~4.1.0-1 · all · trixie
  Affected
  nvd · node-handlebars · debian · 13

Observed: Oct 27, 2026, 10:28:16 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]