CVE-2026-33916 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection