Detections
Analytics

SCA: security update for handlebars (GHSA-3mfm-83xf-c92r)

high Tenable Cloud Security Plugin ID 439360

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through
 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and
 mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites
 `@partial-block` with a crafted Handlebars AST, a subsequent invocation of `{{> @partial-block}}` compiles
 and executes that AST, enabling arbitrary JavaScript execution on the server. Version 4.7.9 fixes the
 issue. Some workarounds are available. First, use the runtime-only build
 (`require('handlebars/runtime')`). The `compile()` method is absent, eliminating the vulnerable fallback
 path. Second, audit registered helpers for any that write arbitrary values to context objects. Helpers
 should treat context data as read-only. Third, avoid registering helpers from third-party packages (such
 as `handlebars-helpers`) in contexts where templates or context data can be influenced by untrusted input.
 (CVE-2026-33938)

Solution

Update the handlebars library and its related packages to version 4.7.9 or later.

See Also

https://github.com/advisories/GHSA-3mfm-83xf-c92r

Plugin Details

Severity: High

ID: 439360

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/27/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.47

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33938

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/27/2026

Vulnerability Publication Date: 3/27/2026

Reference Information

CVE: CVE-2026-33938