CVE-2026-106444 · GHSA-xw65-4hp5-5hc7
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
- Risk score
- 42/100
- CVSS
- 4.7 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. W…
- Affected
- handlebars (npm) >= 4.0.0, <= 4.7.9
- Fix
- Upgrade handlebars to 4.7.10 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
handlebars: Red, act today. Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduc…
The flaws
- CVE-2026-106444: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates (CVSS 4.7 · EPSS 0%)
- CVE-2026-106446: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) (CVSS 9.8 · EPSS 1%)
- CVE-2026-106445: Handlebars: JavaScript Injection via Own Property Check Bypass (CVSS 9.2 · EPSS 0%)
The fix
Upgrade handlebars: 4.7.10 or later on your release line
Who is exposed: handlebars (npm) >= 4.0.0, <= 4.7.9
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-116 (CWE-116). 34 other warnings in 30 days
Why it is Yellow
- CVSS 4.7 medium
- Public exploit or proof of concept referenced
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| handlebars | npm | >= 4.0.0, <= 4.7.9 | 4.7.10 |
References
- https://github.com/advisories/GHSA-xw65-4hp5-5hc7
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7
- https://nvd.nist.gov/vuln/detail/CVE-2026-106444
- https://github.com/handlebars-lang/handlebars.js/pull/2185
- https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10
- https://github.com/advisories/GHSA-xw65-4hp5-5hc7
Original description
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
Last activity 6 Oct 2026. Patch Forecast updates every hour.