CVE-2026-33939

{"id": "CVE-2026-33939", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33939", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T18:52:18.558792Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "handlebars-lang", "product": "handlebars.js", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.7.9"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "vendor": "Red Hat", "product": "Cluster Observability Operator 1.5.0", "versions": [{"status": "unaffected", "version": "1782839279", "lessThan": "*", "versionType": "rpm"}], "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "vendor": "Red Hat", "product": "Cluster Observability Operator 1.5.0", "versions": [{"status": "unaffected", "version": "1782840539", "lessThan": "*", "versionType": "rpm"}], "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "vendor": "Red Hat", "product": "Cluster Observability Operator 1.5.0", "versions": [{"status": "unaffected", "version": "1782839996", "lessThan": "*", "versionType": "rpm"}], "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3.27::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces 3.27", "versions": [{"status": "unaffected", "version": "1776744110", "lessThan": "*", "versionType": "rpm"}], "packageName": "devspaces/code-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cryostat:4"], "vendor": "Red Hat", "product": "Cryostat 4", "packageName": "handlebars", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:logging:5"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/elasticsearch6-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:logging:5"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/elasticsearch-operator-bundle", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:logging:5"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/elasticsearch-proxy-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:logging:5"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/elasticsearch-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:logging:5"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/kibana6-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:logging:5"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "packageName": "openshift-logging/logging-curator5-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "vendor": "Red Hat", "product": "Red Hat Data Grid 8", "packageName": "handlebars", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "firefox", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "thunderbird", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "firefox", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "389-ds:1.4/389-ds-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "firefox", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "grafana", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "mozjs60", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "thunderbird", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "firefox", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "thunderbird", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"], "vendor": "Red Hat", "product": "Red Hat Process Automation 7", "packageName": "handlebars", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-03-27T22:16:20.857", "references": [{"url": "https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:10175", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:34342", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-33939", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452508", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-754"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-248"}]}], "descriptions": [{"lang": "en", "value": "Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, \"n\")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled templates; do not call `compile()` at request time."}], "lastModified": "2026-07-15T02:20:23.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "A9D1F9A7-8359-4C3F-9932-4A085094F388", "versionEndExcluding": "4.7.9", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}