Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options (CVE-2026-33941) | HOL Guard CVE