CVE-2026-106444: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-07
Weakness: CWE-116

Description

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

Affected products

Npm Handlebars: from 4.0.0 before 4.7.10 — fixed in 4.7.10
handlebars-lang handlebars.js: from 4.0.0, < 4.7.10

How to fix

Upgrade to a fixed version: Npm Handlebars 4.7.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-106444 or the next vulnerability affects your stack