The flaw in Handlebars.js versions 4.0.0 through 4.7.8 is a type confusion that allows a crafted object in the template context to be interpreted as a Handlebars abstract syntax tree. The runtime then compiles and executes the injected JavaScript code, giving the attacker arbitrary command execution on the server. This vulnerability is a classic example of CWE‑843 (Type Confusion) combined with CWE‑94 (Code Injection). The primary impact is that an attacker controlling template data can run arbitrary code with the privileges of the Node.js process that renders the template.

The vulnerability affects the Handlebars.js library released by handlebars‑lang for Node.js. All releases from 4.0.0 up to and including 4.7.8 are vulnerable. The issue was fixed in version 4.7.9 and later. Applications that embed user‑controlled data into templates or use dynamic partial syntax such as {{> (lookup …)}} are at risk.

The CVSS base score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. An attacker who can influence a value returned by a dynamic partial lookup can trigger the malicious compilation path, resulting in remote code execution with the same privileges as the running server. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but its ability to execute arbitrary code makes it a serious threat if exploited.