{"id":"EUVD-2026-16847","enisaUuid":"9e0840d6-934d-3484-855a-d5c0717caf11","description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype  pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates  and reduces the attack surface.","datePublished":"Mar 27, 2026, 9:00:48 PM","dateUpdated":"Mar 30, 2026, 3:41:36 PM","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9\nhttps://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2\nhttps://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9\n","aliases":"CVE-2026-33916\nGHSA-2qvq-rjwj-gvw9\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"8d8c198f-020d-32ad-9467-3fe09db0bc49","product":{"name":"handlebars.js","vendor":{"name":"handlebars-lang"}},"product_version":"4.0.0, \u003c 4.7.9"}],"enisaIdVendor":[{"id":"c558702e-5648-381a-a2db-3fc2918725fb","vendor":{"name":"handlebars-lang"}}],"enisaIdVulnerability":[{"id":"2fa9076c-e467-33ce-9169-7b235481b6ab","vulnerability":{"id":"GHSA-2qvq-rjwj-gvw9","description":"Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection","datePublished":"Mar 26, 2026, 10:20:51 PM","dateUpdated":"Mar 27, 2026, 9:52:02 PM","baseScore":0.0,"references":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-23369\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-23383\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33916\nhttps://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2\nhttps://github.com/handlebars-lang/handlebars.js\nhttps://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9\n","enisa_id":"EUVD-2026-16847\n","aliases":"CVE-2026-33916\nGHSA-2qvq-rjwj-gvw9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:54:31 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"88a42265-1902-3d6e-8eca-6702b8b8f0e5","vulnerability":{"id":"CVE-2026-33916","description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prototype-chain traversal. When `Object.prototype` has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply `Object.freeze(Object.prototype)` early in application startup to prevent prototype  pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (`handlebars/runtime`), which does not compile templates  and reduces the attack surface.","datePublished":"Mar 27, 2026, 9:00:48 PM","dateUpdated":"Mar 30, 2026, 3:41:36 PM","status":"PUBLISHED","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-2qvq-rjwj-gvw9\nhttps://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2\nhttps://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9\n","enisa_id":"EUVD-2026-16847\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Oct 30, 2026, 7:18:23 AM","vulnerabilityProduct":[{"id":"365d49d2-8531-3759-94b0-fa34ee757d8e","product":{"name":"handlebars.js","vendor":{"name":"handlebars-lang"}},"product_version":"4.0.0, \u003c 4.7.9"}],"vulnerabilityVendor":[{"id":"7a7a37eb-6db5-3d6c-9673-b43953e19dc1","vendor":{"name":"handlebars-lang"}}]}}],"enisaIdAdvisory":[{"id":"45888c9c-a28f-3b89-94fb-835fcf492879","advisory":{"id":"WID-SEC-W-2026-3046","description":"IBM Concert: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Aug 26, 2026, 10:00:00 PM","dateUpdated":"Aug 30, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3046.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3046\n","aliases":"CVE-2019-19921\nCVE-2021-23337\nCVE-2024-3651\nCVE-2024-39338\nCVE-2024-45590\nCVE-2025-13465\nCVE-2025-15284\nCVE-2025-15599\nCVE-2025-22874\nCVE-2025-47273\nCVE-2025-47907\nCVE-2025-52881\nCVE-2025-53643\nCVE-2025-55184\nCVE-2025-58056\nCVE-2025-58188\nCVE-2025-58189\nCVE-2025-61723\nCVE-2025-61730\nCVE-2025-64649\nCVE-2025-64756\nCVE-2025-67221\nCVE-2025-68121\nCVE-2025-68146\nCVE-2026-0540\nCVE-2026-2327\nCVE-2026-23490\nCVE-2026-23897\nCVE-2026-2391\nCVE-2026-23949\nCVE-2026-24486\nCVE-2026-25528\nCVE-2026-25547\nCVE-2026-25639\nCVE-2026-25990\nCVE-2026-26007\nCVE-2026-26019\nCVE-2026-26996\nCVE-2026-27142\nCVE-2026-27212\nCVE-2026-27699\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-28684\nCVE-2026-29063\nCVE-2026-29181\nCVE-2026-2950\nCVE-2026-31808\nCVE-2026-31900\nCVE-2026-32274\nCVE-2026-32288\nCVE-2026-32597\nCVE-2026-32630\nCVE-2026-32887\nCVE-2026-32952\nCVE-2026-33186\nCVE-2026-33532\nCVE-2026-33750\nCVE-2026-33814\nCVE-2026-33816\nCVE-2026-33916\nCVE-2026-34043\nCVE-2026-34073\nCVE-2026-34077\nCVE-2026-3520\nCVE-2026-35469\nCVE-2026-35515\nCVE-2026-3627\nCVE-2026-39823\nCVE-2026-39825\nCVE-2026-39826\nCVE-2026-39892\nCVE-2026-39984\nCVE-2026-40175\nCVE-2026-40179\nCVE-2026-40181\nCVE-2026-40190\nCVE-2026-40347\nCVE-2026-41066\nCVE-2026-41182\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-41324\nCVE-2026-41425\nCVE-2026-41481\nCVE-2026-41488\nCVE-2026-41602\nCVE-2026-41636\nCVE-2026-42151\nCVE-2026-42154\nCVE-2026-42198\nCVE-2026-42211\nCVE-2026-42338\nCVE-2026-42342\nCVE-2026-42561\nCVE-2026-42577\nCVE-2026-43870\nCVE-2026-44405\nCVE-2026-44431\nCVE-2026-44432\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44496\nCVE-2026-44728\nCVE-2026-4539\nCVE-2026-45409\nCVE-2026-45736\nCVE-2026-46625\nCVE-2026-4800\nCVE-2026-4923\nCVE-2026-4926\nCVE-2026-7246\nCVE-2026-8723\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"76a90dbd-da59-3443-a232-e3bd24181126","product":{"name":"Concert","vendor":{"name":"IBM"}}},{"id":"cc1d243a-3c05-3835-99df-7ead0933e4bb","product":{"name":"3.0.0","vendor":{"name":"ECOVACS"}}}]}},{"id":"976857fc-222a-3c49-bae0-8de61314b69b","advisory":{"id":"WID-SEC-W-2026-1407","description":"IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.","datePublished":"May 6, 2026, 10:00:00 PM","dateUpdated":"Jul 21, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1407.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1407\n","aliases":"CVE-2026-26013\nCVE-2026-27142\nCVE-2026-28277\nCVE-2026-28684\nCVE-2026-32288\nCVE-2026-33151\nCVE-2026-33349\nCVE-2026-33532\nCVE-2026-33891\nCVE-2026-33894\nCVE-2026-33895\nCVE-2026-33896\nCVE-2026-33916\nCVE-2026-34601\nCVE-2026-35469\nCVE-2026-39406\nCVE-2026-39407\nCVE-2026-39408\nCVE-2026-39409\nCVE-2026-39410\nCVE-2026-39983\nCVE-2026-40175\nCVE-2026-40347\nCVE-2026-40895\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-4923\nCVE-2026-4926\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"1da851f2-46b2-3f72-bd8d-c5e540fff7b1","product":{"name":"IBM App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"1ee0a58b-ee30-38f3-8f79-3f7afdcf6bcc","product":{"name":"13.0.1.0-13.0.7.1","vendor":{"name":"IBM"}}},{"id":"20693e59-f8af-3bfa-811d-66f576b9f01b","product":{"name":"Certified Container Operator 13.1.0","vendor":{"name":"IBM"}}},{"id":"2ea27a91-df29-3e77-8d1e-d5cf6a0af1be","product":{"name":"OpenShift Container Platform 4.20.29","vendor":{"name":"Red Hat"}}},{"id":"4599b3fa-7044-3f98-aba8-96a474e990ef","product":{"name":"12.0.1.0-12.0.12.26","vendor":{"name":"IBM"}}},{"id":"4748ab34-e212-3c92-98f8-75ad8c724243","product":{"name":"Certified Container Operator 12.0.23","vendor":{"name":"IBM"}}},{"id":"487ea5f3-668c-3d1d-b01e-19fcd2e8edf4","product":{"name":"Sterling Connect:Direct","vendor":{"name":"IBM"}}},{"id":"48fc3d55-7560-3485-b1bf-7b93cbfbcaab","product":{"name":"IBM Business Automation Workflow","vendor":{"name":"IBM"}}},{"id":"6b89409c-2713-39f6-ab33-0f0fe83a0554","product":{"name":"Web Services","vendor":{"name":"Oracle Corporation"}}},{"id":"6d548be2-225f-3361-8ef3-9191472ae52f","product":{"name":"Collaboration and Deployment Services","vendor":{"name":"IBM"}}},{"id":"7077353c-0265-37a1-8209-100db8c6f7b4","product":{"name":"IBM QRadar SIEM","vendor":{"name":"IBM"}}},{"id":"763f11a2-f41c-3b1f-b2e9-f0bbaf3a0d14","product":{"name":"App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"8ed582ca-ad30-34d3-8bab-bede2901affe","product":{"name":"SUSE Linux","vendor":{"name":"SUSE"}}},{"id":"9d55801f-b587-3c77-b2d2-15be18978b7f","product":{"name":"IBM Maximo Asset Management","vendor":{"name":"IBM"}}},{"id":"aa54c55f-7b3a-3292-baf8-7d5eb95bf237","product":{"name":"Enterprise Linux","vendor":{"name":"Red Hat"}}},{"id":"aad28b78-3131-37bd-a45c-c69282a523db","product":{"name":"MQ","vendor":{"name":"IBM"}}},{"id":"af93b134-9f23-3f56-a116-c2f37abda51d","product":{"name":"operator","vendor":{"name":"minio"}}},{"id":"baffe41c-8df9-3046-9dfa-735c68bcbb5f","product":{"name":"SPSS","vendor":{"name":"IBM"}}},{"id":"bc9d8ac9-0456-3d7e-b870-a4e7bac1edfe","product":{"name":"13.0.1.0-13.0.7.0","vendor":{"name":"IBM"}}},{"id":"c3af98cc-cc4a-33e5-8f98-627355517d33","product":{"name":"12.0.1.0-12.0.12.25","vendor":{"name":"IBM"}}},{"id":"d19ede16-7e92-3ca5-b30c-ba57c9353243","product":{"name":"Fedora Linux","vendor":{"name":"Fedora"}}},{"id":"e027ec01-4704-3d40-abc0-ac8f454c9226","product":{"name":"OpenShift","vendor":{"name":"n/a"}}},{"id":"e9ac7cd8-05ee-381a-8f2d-497f6b99ca44","product":{"name":"9 Multicluster Engine for Kubernetes 2.8.6","vendor":{"name":"Red Hat"}}},{"id":"ea35925a-1a5f-3bf4-a795-300f3694f657","product":{"name":"13.0.7.1","vendor":{"name":"IBM"}}},{"id":"fbebe4c7-7861-344a-802e-4cf0ea171ffc","product":{"name":"Red Hat Enterprise Linux","vendor":{"name":"Red Hat"}}}]}},{"id":"c4b3e5ad-0aff-3c27-b67d-9241bed10446","advisory":{"id":"msrc_CVE-2026-33916","description":"Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection","datePublished":"Mar 2, 2026, 12:00:00 AM","dateUpdated":"Apr 30, 2026, 1:46:08 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-33916.json\n","aliases":"CVE-2026-33916\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"2237afcd-4df0-3327-a297-e73757c91c82","product":{"name":"reaper","vendor":{"name":"Microsoft"}}},{"id":"c333d3cd-3654-398c-b244-a04a2fe68d97","product":{"name":"2.0","vendor":{"name":"Smiths Medical"}}},{"id":"c3ff0d07-9170-349e-972c-2cf304f5dc7e","product":{"name":"cbl2 reaper 0:3.1.1-22.cbl2","vendor":{"name":"Microsoft"}}},{"id":"d9975f26-9790-3754-8e2e-c3904e780406","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}}]}}]}