Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package kibana-9.2-config  (opens in a new tab)

Threat Intelligence

EPSS
0.28% (21st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KIBANA92CONFIG-16345392
  • published3 May 2026
  • disclosed27 Mar 2026
Report a new vulnerability Found a mistake?

Introduced: 27 Mar 2026

CVE-2026-33916  (opens in a new tab)
CWE-79  (opens in a new tab)
CWE-1321  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kibana-9.2-config package and not the kibana-9.2-config package as distributed by Minimos.

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, resolvePartial() in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS. Version 4.7.9 fixes the issue. Some workarounds are available. Apply Object.freeze(Object.prototype) early in application startup to prevent prototype pollution. Note: this may break other libraries, and/or use the Handlebars runtime-only build (handlebars/runtime), which does not compile templates and reduces the attack surface.