AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-917

https://access.redhat.com/errata/RHSA-2026:10175

https://access.redhat.com/security/cve/CVE-2026-33938

https://bugzilla.redhat.com/show_bug.cgi?id=2452525

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33938.json

[{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces 3.27","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_devspaces:3.27::el9"]},{"vendor":"Red Hat","product":"Logging Subsystem for Red Hat OpenShift","defaultStatus":"affected","cpes":["cpe:/a:redhat:logging:5"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Cryostat 4","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:cryostat:4"]},{"vendor":"Red Hat","product":"Red Hat Data Grid 8","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat Process Automation 7","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"]}]

{"timestamp":"2026-03-31T00:00:00+00:00","id":"CVE-2026-33938","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"handlebars-lang","product":"handlebars.js","versions":[{"version":">= 4.0.0, < 4.7.9","status":"affected"}]}]

https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r

OR
          *cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:* versions from (including) 4.0.0 up to (excluding) 4.7.9

GitHub, Inc.: https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 Types: Patch

GitHub, Inc.: https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 Types: Release Notes

GitHub, Inc.: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r Types: Exploit, Vendor Advisory

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (`require('handlebars/runtime')`). The `compile()` method is  absent, eliminating the vulnerable fallback path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers  should treat context data as read-only. Third, avoid registering helpers from third-party packages (such as `handlebars-helpers`) in  contexts where templates or context data can be influenced by untrusted input.

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-94

CWE-843

https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2

https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9

https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-3mfm-83xf-c92r