Handlebars.js versions 4.0.0 through 4.7.8 contain a vulnerability where the @partial-block special variable is accessible and mutable within templates via helpers that accept arbitrary objects. If a helper overwrites @partial-block with a crafted Handlebars AST, a later invocation of {{> @partial-block}} compiles and executes that AST, enabling arbitrary server-side JavaScript execution. This vulnerability is fixed in version 4.7.9. Mitigations include using the runtime-only build which lacks the compile() method, auditing helpers to prevent writing arbitrary values to context objects, and avoiding registration of third-party helpers in contexts influenced by untrusted input.

Successful exploitation allows an attacker to execute arbitrary JavaScript code on the server, leading to full compromise of the server environment. This can result in complete confidentiality, integrity, and availability loss of the affected system. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

An official fix is available in handlebars.js version 4.7.9. Users should upgrade to this version to remediate the vulnerability. If upgrading immediately is not possible, use the runtime-only build of handlebars.js which does not include the vulnerable compile() method. Additionally, audit all registered helpers to ensure they do not overwrite context data such as @partial-block with arbitrary values, and avoid registering third-party helpers in environments where templates or context data can be influenced by untrusted input.