CVE-2026-106444

CVE-2026-106444 · Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

CVSS 4.7 · Moyenne · EPSS 0,3% · Correctif disponible

Publication

2026-10-06T19:01:14.626Z

Mise à jour

2026-10-06T19:48:02.050Z

Pile logicielle: system · node

Vérifiez votre serveur →