CVE-2026-33937

The `Handlebars.compile()` function accepts not only a template string, but also a pre-processed AST (Abstract Syntax Tree) object. The value of the `value` field in a `NumberLiteral` type AST node is inserted directly into the generated JavaScript code without any quoting or sanitization. An attacker who can supply a crafted AST object to the `compile()` function — for example, through JSON deserialization — can inject arbitrary JavaScript code that will then be executed on the server side.

An attacker can execute arbitrary JavaScript code on the server (RCE), which potentially leads to complete system compromise, data leakage, or violation of application integrity.

The Handlebars.js library should be updated to version 4.7.9, which fixes the vulnerability. As a workaround, you can: (1) validate the argument type before calling `Handlebars.compile()` — ensure it is always a string (`string`), never an object or value obtained through JSON deserialization; (2) use the runtime-only version (`handlebars/runtime`) on the server if templates are compiled at build time — the `compile()` function will then be unavailable.

Handlebars.js (package `handlebars`) in versions from 4.0.0 to 4.7.8 inclusive.