CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
Handlebars.compile() and Handlebars.precompile() accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.64% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- handlebars (npm) >= 4.0.0, <= 4.7.9, fixed in 4.7.10 · GHSA-8r5x-fm3f-whwj