CVE-2026-33937Proof of concept (PoC) published · CISASuited to automated attack · CISA
Handlebars.js has JavaScript Injection via AST Type Confusion
CVSS score
9.8
EPSS probability
%1.7
Risk score
0.2
Published
6 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
Python POC, Exploit for Handlebars.js AST Injection RCE, Handlebars.js versions 4.0.0 through 4.7.8 are affected. CVSS score: 9.8 Critical.
Makefile Go / Python
this is a poc for CVE-2026-33937
Makefile Go / Python
GitHub
CVE-2026-33937 Handlebars RCE exploit PoC (AST Injection)
Makefile Go / Python
GitHub
Handlebars.js AST Injection Remote Code Execution Vulnerability
Makefile Go / Python
Similar Vulnerabilities
5.6
CVE-2021-23369
Remote Code Execution (RCE)
N
Patch verifiedEPSS %7
8.1
CVE-2019-20920
Vulnerability in N/a
N
Patch status unknownEPSS %3
5.6
CVE-2021-23383
Prototype Pollution
N
Patch verifiedEPSS %5
8.1
CVE-2026-33938
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
H
Patch verifiedEPSS %1
8.1
CVE-2026-33940
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
H
Patch verifiedEPSS %1
9.8
CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
H
Patch status unknownEPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-33937"