CVE-2026-106444: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Handlebarsto a version that resolves this vulnerability.Fixed in 4.7.10
Event History
Frequently Asked Questions
Which deployments are actually exposed to this issue?
Exposure requires an application to precompile attacker-controlled Handlebars template text and embed the resulting generated source directly in an inline HTML script element. Ordinary server-side rendering and precompiled templates delivered as external JavaScript files are not affected.
What must an attacker be able to do to exploit it?
An attacker must be able to supply template text that the application passes to Handlebars.precompile(), with the generated output subsequently placed in an inline script element. The template text must contain a sequence that terminates that enclosing script element so that following attacker-controlled markup is parsed and executed.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required, although the provided data does not specify the exact interaction involved.
What version fixes the issue?
Handlebars 4.7.10 fixes the issue. Affected versions are 4.0.0 through versions before 4.7.10.