Handlebars.js versions 4.0.0 through 4.7.8 have a type confusion vulnerability (CWE-843) where the compile() function accepts a pre-parsed AST object. The value field of a NumberLiteral AST node is emitted directly into generated JavaScript code without quoting or sanitization, enabling an attacker with the ability to supply a crafted AST to perform remote code execution on the server. This vulnerability is tracked as CVE-2026-33937 and has a CVSS 3.1 score of 9.8 (critical). The issue is resolved in version 4.7.9. Mitigations include validating that the input to compile() is always a string and never a plain object, or using the runtime-only build on the server side to avoid using compile().

Successful exploitation allows an unauthenticated attacker who can supply a crafted AST object to Handlebars.compile() to execute arbitrary JavaScript code remotely on the server, leading to full compromise of the server environment. The vulnerability affects confidentiality, integrity, and availability with a critical severity rating (CVSS 9.8).

An official fix is available in Handlebars.js version 4.7.9. Users should upgrade to this version to remediate the vulnerability. Until upgrading, mitigate by validating input types before calling Handlebars.compile() to ensure the argument is always a string and not a deserialized object. Alternatively, use the Handlebars runtime-only build on the server if templates are pre-compiled at build time, which disables the compile() function and prevents exploitation.