CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion