CVE-2026-33916
Description
A flaw was found in Handlebars. The resolvePartial() function in the Handlebars runtime does not properly guard against prototype-chain traversal when resolving partial names. This allows an attacker to inject malicious code into web pages. When Object.prototype has been polluted with a string value that matches a partial reference, the polluted string is used as the partial body and rendered without proper HTML escaping. This can result in reflected or stored Cross-Site Scripting (XSS), potentially leading to arbitrary code execution in a user's browser or information disclosure.
Statement
Moderate: This vulnerability in Handlebars allows for Cross-Site Scripting (XSS) when an application uses Handlebars versions 4.0.0 through 4.7.8 and is susceptible to prototype pollution. An attacker could inject malicious code into web pages, potentially leading to arbitrary code execution in a user's browser or information disclosure. This affects Red Hat products that embed or utilize vulnerable versions of the Handlebars library.
Mitigation
To mitigate this issue, apply `Object.freeze(Object.prototype)` early in the application startup to prevent prototype pollution. Alternatively, use the Handlebars runtime-only build (`handlebars/runtime`), which reduces the attack surface by not compiling templates. Be aware that applying `Object.freeze(Object.prototype)` may impact the functionality of other libraries within the application. Applications utilizing Handlebars may require a restart for these changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | 4.7 | 4.7 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | High | High |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Changed | Changed | Changed |
| Confidentiality | Low | Low | Low |
| Integrity Impact | Low | Low | Low |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
