Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M
CVE-2026-106446Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
Critical 9.8
In plain English
A critical-severity code injection in handlebars.js from handlebars-lang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object instead of a template string can place JavaScript expressions in unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. The compiler emits those values into generated JavaScript, causing code execution in the server process when compile output renders or wherever precompile output is loaded. Applications that pass only template strings are not affected. This issue is fixed in version 4.7.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-handlebars | no fix listed | DEBIAN-CVE-2026-106446 |
| Debian:13 | node-handlebars | no fix listed | DEBIAN-CVE-2026-106446 |
| Debian:14 | node-handlebars | 3:4.7.10-1 | DEBIAN-CVE-2026-106446 |
| Ubuntu:22.04:LTS | node-handlebars | no fix listed | UBUNTU-CVE-2026-106446 |
| Ubuntu:24.04:LTS | node-handlebars | no fix listed | UBUNTU-CVE-2026-106446 |
| Ubuntu:26.04:LTS | node-handlebars | no fix listed | UBUNTU-CVE-2026-106446 |
| Ubuntu:26.10 | node-handlebars | no fix listed | UBUNTU-CVE-2026-106446 |
| Ubuntu:22.04:LTS | ruby-handlebars-assets | no fix listed | UBUNTU-CVE-2026-106446 |
| Ubuntu:24.04:LTS | ruby-handlebars-assets | no fix listed | UBUNTU-CVE-2026-106446 |
| npm | handlebars | 4.7.10 | GHSA-8r5x-fm3f-whwj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| handlebars-lang | handlebars.js | >= 4.0.0, < 4.7.10 |
Weakness: CWE-94, CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj x_refsource_CONFIRM
- https://github.com/handlebars-lang/handlebars.js/pull/2185 x_refsource_MISC
- https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2 x_refsource_MISC
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10 x_refsource_MISC