Handlbars.compile and precompile can accept a JavaScript object that represents a parsed template. The vendor only validates a narrow set of node types, leaving unvalidated fields such as Program.blockParams.length, non‑PathExpression depth, non‑string StringLiteral.value, or non‑string PathExpression.original to propagate. Those values are interpolated into the generated JavaScript code. An attacker who can supply such an object can cause arbitrary code execution in the Node.js process that runs the generated template or loads the precompiled bundle. The 9.8 CVSS score reflects the complete loss of confidentiality, integrity and availability. The vulnerability stems from type confusion (CWE‑843) and code injection (CWE‑94).

Any deployment of Handlebars.js from version 4.0.0 up through, but not including, 4.7.10 is vulnerable. The fix was introduced in 4.7.10, so that release or any newer release is not affected. Applications that only pass raw template strings are not impacted, because the vulnerability requires an object input.

The exploit hinges on supplying a crafted AST object to the compile or precompile function. This is possible when the application accepts external template definitions or precompiled bundles. Once the object is processed, the injected JavaScript runs in the same context as the server, giving full control. The EPSS score is not published, but the 9.8 CVSS score and the absence from the CISA KEV list still indicate a serious threat. The likely attack vector is the compile/precompile APIs, which accept objects rather than strings.