handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) · Teire