Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-106444Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Medium 4.7

In plain English

A medium-severity security flaw in handlebars.js from handlebars-lang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-handlebars	no fix listed	DEBIAN-CVE-2026-106444
Debian:13	node-handlebars	no fix listed	DEBIAN-CVE-2026-106444
Debian:14	node-handlebars	3:4.7.10-1	DEBIAN-CVE-2026-106444
Ubuntu:22.04:LTS	node-handlebars	no fix listed	UBUNTU-CVE-2026-106444
Ubuntu:24.04:LTS	node-handlebars	no fix listed	UBUNTU-CVE-2026-106444
Ubuntu:26.04:LTS	node-handlebars	no fix listed	UBUNTU-CVE-2026-106444
Ubuntu:26.10	node-handlebars	no fix listed	UBUNTU-CVE-2026-106444
Ubuntu:22.04:LTS	ruby-handlebars-assets	no fix listed	UBUNTU-CVE-2026-106444
Ubuntu:24.04:LTS	ruby-handlebars-assets	no fix listed	UBUNTU-CVE-2026-106444
npm	handlebars	4.7.10	GHSA-xw65-4hp5-5hc7

Affected products (as reported)

Vendor	Product	Versions
handlebars-lang	handlebars.js	>= 4.0.0, < 4.7.10

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7 x_refsource_CONFIRM
https://github.com/handlebars-lang/handlebars.js/pull/2185 x_refsource_MISC
https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725 x_refsource_MISC
https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10 x_refsource_MISC