CVE-2026-33940: 
Grafana vulnerability analysis and mitigation

CVE-2026-33940 is a JavaScript injection vulnerability in the Handlebars.js template engine, described as "JavaScript Injection via AST Type Confusion when passing an object as dynamic partial." It affects Handlebars npm package versions 4.0.0 through 4.7.8 and was disclosed on March 26, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Github Advisory). Multiple IBM products that bundle Handlebars are also affected, including IBM App Connect Enterprise, IBM API Connect, IBM Cloud Pak for Integration, IBM Business Automation Manager Open Editions, and others (IBM ACE Advisory, IBM Cloud Pak Advisory).

The vulnerability is rooted in a type confusion flaw (CWE-843) combined with improper code generation control (CWE-94) in lib/handlebars/runtime.js. An attacker crafts a JavaScript object with call: true and a valid Handlebars AST structure containing injected code, then places it in the template rendering context. When a template uses a dynamic partial lookup (e.g., {{> (lookup . "key")}}), resolvePartial() is tricked by the call: true property into returning the crafted object as-is, bypassing all type guards. invokePartial() then receives a non-function object, produces undefined, and the runtime falls back to calling env.compile(partial, ...) on the attacker-controlled AST object — causing the JavaScript code generator to emit and evaluate arbitrary injected code. The key precondition is that the adversary must control a value reachable via a dynamic partial lookup in the template context, which is common in server-side rendering scenarios with user-supplied data (GitHub Advisory, Patch Commit).

Successful exploitation enables full Remote Code Execution (RCE) on the server running the Handlebars application, with the process running under the Node.js service account's privileges. An attacker can execute arbitrary operating system commands, exfiltrate sensitive data, establish persistence, or pivot laterally within the affected environment. All three security dimensions are impacted at a high level: confidentiality (data access), integrity (data/system modification), and availability (service disruption) (GitHub Advisory, Github Advisory).

A public proof-of-concept (PoC) exploit is available in the official GitHub Security Advisory, demonstrating RCE via a self-contained JavaScript snippet that invokes Handlebars.compile() with a crafted malicious AST object (GitHub Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.032% (10th percentile), indicating a currently low probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures are available in Nessus (plugin 304164) and Qualys.

1. Identify a vulnerable target: Find a Node.js application using Handlebars npm versions 4.0.0–4.7.8 for server-side template rendering, where user-controlled data is passed as template context. Tools like npm audit, Shodan, or source code review can identify candidates.
2. Confirm dynamic partial usage: Verify the application's templates use dynamic partial lookups such as {{> (lookup . "key")}} or equivalent, where the looked-up key's value can be influenced by attacker-controlled input.
3. Craft the malicious context object: Construct a JavaScript object with call: true (to bypass resolvePartial()'s primary branch) and a valid Handlebars AST structure (type: "Program") containing a PathExpression node whose depth field is set to a string containing injected JavaScript code (e.g., "0])),function () {console.error('VULNERABLE: object -> dynamic partial -> RCE');}()));//").
4. Inject the payload: Submit the crafted object as the value of the context property referenced by the dynamic partial lookup — for example, via a JSON API request body, form field, or any other user-controlled input channel that populates the template context.
5. Trigger template rendering: Cause the application to render the vulnerable template with the malicious context (e.g., by submitting a form, making an API call, or triggering a page load).
6. Achieve RCE: The Handlebars runtime calls env.compile() on the crafted AST, the JavaScript code generator emits and evaluates the injected payload, executing arbitrary commands on the server under the Node.js process's privileges (GitHub Advisory).

• Logs: Unexpected JavaScript errors or stack traces in Node.js application logs referencing invokePartial, resolvePartial, or env.compile with non-string/non-function arguments; error output matching VULNERABLE: object -> dynamic partial -> RCE or similar injected strings during testing.
• Process: Unusual child processes spawned by the Node.js application process (e.g., sh, bash, cmd.exe, curl, wget, python, powershell) that are not part of normal application behavior.
• Network: Unexpected outbound connections from the Node.js server to external IPs or domains, particularly shortly after template rendering requests; reverse shell connections or data exfiltration traffic.
• File System: New or modified files in the application directory or system temp directories created by the Node.js process; unexpected cron jobs, scheduled tasks, or startup scripts added by the service account.
• Application Behavior: Template rendering requests containing context data with deeply nested objects including keys such as call, type: "Program", body, MustacheStatement, or PathExpression in user-supplied JSON payloads (GitHub Advisory).

The primary remediation is to upgrade Handlebars to version 4.7.9 or later, which introduces AST input validation in parseWithoutProcessing() to reject crafted objects with invalid node field types before they reach the code generator (v4.7.9 Release, Patch Commit). If immediate upgrade is not possible, three workarounds are available: (1) switch to the runtime-only build (require('handlebars/runtime')), which eliminates the compile() fallback path entirely; (2) sanitize all template context data to ensure no value is a non-primitive object that could be passed to a dynamic partial; (3) avoid using dynamic partial lookups ({{> (lookup ...)}}) when any part of the context is user-controlled. IBM has released advisories and patches for affected products including App Connect Enterprise, API Connect, Cloud Pak for Integration, Business Automation Manager Open Editions, and others (IBM ACE Advisory, IBM Cloud Pak Advisory).

The vulnerability was reported by security researcher evanj2357 and published by maintainer jaylinski on March 26, 2026 (GitHub Advisory). IBM issued multiple security bulletins for its affected products throughout April and May 2026, indicating broad downstream impact across enterprise software (IBM ACE Advisory, IBM Cloud Pak Advisory). Community tracking was observed on platforms including Bluesky, VulDB, and CVEFeed shortly after disclosure, reflecting moderate security community interest.