Handlebars.js versions 4.0.0 to 4.7.8 contain a vulnerability where the @partial-block special variable is accessible and mutable within templates via helpers that accept arbitrary objects. If a helper overwrites @partial-block with a malicious Handlebars AST, a subsequent invocation of {{> @partial-block}} compiles and executes that AST, enabling arbitrary server-side JavaScript execution. This is a code injection vulnerability classified under CWE-94 and CWE-843. The vulnerability is addressed in version 4.7.9. Mitigations include using the runtime-only build which lacks the compile() method, auditing helpers to ensure they treat context data as read-only, and avoiding third-party helpers in contexts influenced by untrusted input.

Successful exploitation allows an attacker to execute arbitrary JavaScript code on the server, potentially leading to full server compromise, data theft, or service disruption. The CVSS score of 8.1 (high) reflects the network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An official fix is available in handlebars.js version 4.7.9; upgrading to this version is recommended. If immediate upgrade is not possible, use the runtime-only build (require('handlebars/runtime')) which removes the vulnerable compile() method. Additionally, audit all registered helpers to ensure they do not mutate context data, especially the @partial-block variable. Avoid registering helpers from third-party packages in environments where templates or context data can be influenced by untrusted input.