p PatchFirst

CVE-2026-106444

CVE-2026-106444 · Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

CVSS 4.7 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • handlebars.js

    Versions
    • >= 4.0.0, < 4.7.10: Affected

    No fix published

  • node-handlebars Debian:12

    Versions
    • 3:4.7.10-1
    • 3:4.7.7+~4.1.0-1
    • 3:4.7.9-1
    • 3:4.7.9-2
    • 3:4.7.9-3
    • 3:4.7.9-4
    • 3:4.7.9-5
    • 3:4.7.9-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Debian:13

    Versions
    • 3:4.7.10-1
    • 3:4.7.7+~4.1.0-1
    • 3:4.7.9-1
    • 3:4.7.9-2
    • 3:4.7.9-3
    • 3:4.7.9-4
    • 3:4.7.9-5
    • 3:4.7.9-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Debian:14

    Versions
    • 3:4.7.7+~4.1.0-1
    • 3:4.7.9-1
    • 3:4.7.9-2
    • 3:4.7.9-3
    • 3:4.7.9-4
    • 3:4.7.9-5
    • 3:4.7.9-6
    Affected ranges
    • ECOSYSTEM: < 3:4.7.10-1

    Update to 3:4.7.10-1

  • handlebars npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 4.7.10

    Update to 4.7.10

  • ruby-handlebars-assets Ubuntu:16.04:LTS

    Versions
    • 0.15-2
    • 2:0.20.2-2
    • 2:0.21.0-2
    • 2:0.21.0-3
    • 2:0.21.0-4
    • 2:0.21.0-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:18.04:LTS

    Versions
    • 3:4.0.10-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-handlebars-assets Ubuntu:18.04:LTS

    Versions
    • 2:0.23.1-1
    • 2:0.23.2-2
    • 2:0.23.2+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:20.04:LTS

    Versions
    • 3:4.1.0-1
    • 3:4.5.3-1
    • 3:4.7.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-handlebars-assets Ubuntu:20.04:LTS

    Versions
    • 2:0.23.3+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:22.04:LTS

    Versions
    • 3:4.7.6+~4.1.0-2
    • 3:4.7.7+~4.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-handlebars-assets Ubuntu:22.04:LTS

    Versions
    • 2:0.23.8+dfsg-3
    • 2:0.23.8+dfsg-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:24.04:LTS

    Versions
    • 3:4.7.7+~4.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-handlebars-assets Ubuntu:24.04:LTS

    Versions
    • 2:0.23.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:26.10

    Versions
    • 3:4.7.7+~4.1.0-1
    • 3:4.7.9-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-handlebars Ubuntu:26.04:LTS

    Versions
    • 3:4.7.7+~4.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →