Loading story…
Two high-severity vulnerabilities in Handlebars.js can let attackers execute arbitrary JavaScript on servers by abusing how the template engine handles partials. Tracked as CVE-2026-33938 and CVE-2026-33940, the flaws affect versions 4.0.0 through 4.7.8 and were fixed in 4.7.9. In one case, an attacker can tamper with the special variable @partial-block so that a later {{> @partial-block}} call compiles and runs a crafted Handlebars AST; in the other, a malicious object returned through a dynamic partial lookup can be treated as template input and compiled into executable server-side code.
The vulnerabilities arise from AST type confusion in partial resolution and compilation paths, creating a route from attacker-controlled template data to code generation inside the Handlebars environment. Organizations using Handlebars in server-side rendering or other trusted execution contexts are exposed if untrusted input can influence helpers, context objects, or dynamic partial selection. Defenders are advised to upgrade to Handlebars 4.7.9, prefer the runtime-only build where possible, audit helpers that write to template context, sanitize non-primitive objects from user-controlled data, and avoid third-party helpers or dynamic partial lookups in untrusted workflows.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Public advisories described two high-severity Handlebars vulnerabilities: CVE-2026-33938 involving `@partial-block` AST type confusion and CVE-2026-33940 involving dynamic partials accepting crafted objects. Both disclosures noted server-side arbitrary JavaScript or command execution risk and recommended mitigations such as using the runtime-only build and restricting untrusted helper or context input.
Handlebars addressed two vulnerabilities affecting versions 4.0.0 through 4.7.8 in release 4.7.9. One flaw allowed JavaScript injection by tampering with `@partial-block`, and the other allowed attacker-controlled AST compilation through dynamic partial resolution, both leading to arbitrary server-side code execution.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, tracked as **`CVE-2026-45618`**, was disclosed in the **LiquidJS** template engine from harttle. The flaw affects versions earlier than **`10.26.0`** and allows arbitrary code execution through crafted templates, with a **CVSS 3.1** score reflecting network-exploitable impact without privileges or user interaction. The issue is classified as **`CWE-94`**, indicating improper control of code generation that can lead to command execution. Harttle addressed the issue in **LiquidJS `v10.26.0`** by blocking **`Object.prototype`** filter and tag lookups, the behavior identified as enabling the RCE condition. The same release also rewrote **`strip_html`** as a linear single-pass scan to reduce **ReDoS** risk and included additional bug fixes and new `sha256` and `hmac_sha256` filters. Organizations using LiquidJS should upgrade to **`10.26.0`** or later to remediate the vulnerability.
Aug 12, 2026
Multiple critical vulnerabilities in **JSONata** allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as `CVE-2026-77413`, `CVE-2026-77414`, and `CVE-2026-77415`, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke `process.getBuiltinModule` and `child_process`. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement. Project maintainers shipped a series of hardening changes across the `1.x` and `2.x` branches, including blocking `$lookup` access to prototype members, replacing vulnerable objects with `Object.create(null)`, using safer `Object.prototype.hasOwnProperty.call` checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as `_jsonata_lambda` and `_jsonata_function`. Affected versions include releases before `1.8.8` and `2.x` versions prior to `2.2.1`, with fixes delivered through `1.8.8`/`1.8.9`, `2.2.0`, and `2.2.1`; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
Aug 22, 2026
Two newly disclosed vulnerabilities affect widely used JavaScript server components, with one enabling **application-level denial of service** in `h3` and the other causing **cross-client data exposure** in `mcp-handler`. The `h3` flaw, tracked as `GHSA-Q5PR-72PQ-83V3`, is an algorithmic complexity issue in chunked cookie processing that lets an attacker send a very small HTTP request and force disproportionate CPU consumption. Rated **CVSS 7.5**, the bug can starve event loops and degrade availability without requiring privileges or user interaction. A separate issue in `mcp-handler`, tracked as `GHSA-W2FM-25VW-VH7F`, stems from a transport race condition that can leak sensitive MCP tool responses across client sessions. The vulnerability, rated **CVSS 7.1**, can expose database query results, local file contents, proprietary data, and raw large language model outputs, while also allowing limited attacker-controlled input injection when misrouted requests are processed in a victim session. The risk is highest in stateless serverless deployments such as **AWS Lambda** or edge runtimes where developers reuse global `McpServer` or `StreamableHTTPServerTransport` instances, while persistent Node.js deployments that create transport objects per connection are described as resistant to this specific flaw.
Jun 29, 2026