Skip to content
OpenAdvisories
High WID-SEC-2026-3655 6 CVEs

IBM InfoSphere Data Replication: Mehrere Schwachstellen

Published Sep 29, 2026 · Updated Sep 29, 2026 · de-DE

Vendor: IBM Product: InfoSphere Data Replication Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM InfoSphere Data Replication ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen und um einen Cross-Site Scripting Angriff durchzuführen.

Product

IBM InfoSphere Data Replication bietet protokollbasierte Änderungsdatenerfassung mit Transaktionsintegrität zur Unterstützung von Big-Data-Integration und Konsolidierung sowie für maßgeschneiderte Warehousing- und Analyseinitiativen.

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-33937 Public exploit

    Handlebars.js has JavaScript Injection via AST Type Confusion

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 8.3
    CVE-2026-33941

    Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names and several CLI…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2026-33938

    Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via helpers that a…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2026-33940

    Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to return `unde…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-33939

    Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProp…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 4.7
    CVE-2026-33916

    Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without guarding against prot…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm

Revision history

  1. #1

    Initiale Fassung

References