CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block