The vulnerability allows an attacker who can influence Handlebars template filenames or command‑line options to inject arbitrary JavaScript into the bundle generated by the CLI precompiler. The undersanitized concatenation of user‑controlled strings into the emitted code creates a classic code‑injection flaw that can execute when the bundle is loaded in Node.js or a browser. This enables remote code execution and compromises confidentiality, integrity, and availability of the runtime environment.

Versions of Handlebars.js from 4.0.0 up to and including 4.7.8 are affected when the CLI precompiler is used. The problem is tied to the CLI tool bin/handlebars and its underlying precompiler script. The issue affects all platforms where Node.js is used to compile templates, as well as browsers that load the generated bundle. Handlebars‑lang:handlebars.js is the vendor, and the Fix appears in release 4.7.9.

The CVSS score of 8.3 indicates a high‑severity vulnerability. EPSS is reported as below 1 % and the issue is not listed in CISA’s KEV catalog, which suggests limited automated exploitation data at present. The likely attack vector derives from a user running the Handlebars CLI with crafted template filenames or options, a scenario common in automated build pipelines or local development. If an attacker can control the precompile step, they can inject executable JavaScript, which then runs with the privileges of the process loading the bundle.