Read the docs
TI-2026-68896 Aliases CVE-2026-106444GHSA-xw65-4hp5-5hc7

Script injection in Handlebars precompiled templates

Priority MEDIUM 55CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Handlebars from 4.0.0 before 4.7.10 is affected. Its Handlebars.precompile() function does not escape sequences that close an HTML script element in the generated code (CWE-116). When an application precompiles attacker-controlled template text and embeds the output directly in an inline script element, injected markup can run in the page, and a user must interact with the page for this to happen.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix Fixed handlebars.js (handlebars-lang): 4.7.10handlebars (npm): 4.7.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
handlebars-langhandlebars.js4.0.0 to before 4.7.104.7.10Patch availableCNA
—handlebars (npm)4.0.0 to before 4.7.104.7.10Patch availableGHSA-xw65-4hp5-5hc7
  • handlebars.js Vendorhandlebars-lang Affected 4.0.0 to before 4.7.10 Fixed in 4.7.10 Patch available CNA
  • handlebars (npm) Vendor— Affected 4.0.0 to before 4.7.10 Fixed in 4.7.10 Patch available GHSA-xw65-4hp5-5hc7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:*:*:*——handlebars-lang
  • cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:*:*:* Versions — — ·handlebars-lang

Remediation

Upgrade the npm package handlebars to version 4.7.10. The sources list no fixed version for handlebars.js.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA handlebars.js (handlebars-lang) Fixed in 4.7.10
  • Fix · GHSA-xw65-4hp5-5hc7 handlebars (npm) Fixed in 4.7.10 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106444
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Priority changed: LOW → MEDIUM
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-07 CVSS score added · Red Hat
  6. 2026-10-08 Alias added: GHSA-xw65-4hp5-5hc7
  7. 2026-10-08 Fix available: npm/[email protected] · GHSA-xw65-4hp5-5hc7
  8. 2026-10-08 CVSS score added · GHSA-xw65-4hp5-5hc7
  9. 2026-10-08 Weakness changed · GHSA-xw65-4hp5-5hc7
  10. 2026-10-08 6 new references · GHSA-xw65-4hp5-5hc7

References

Advisory 1

Other 5

  • TI-2026-68926 JavaScript injection in Handlebars compile via crafted AST objects CVSS 3.1CRITICAL 9.8
  • TI-2026-26288 Handlebars.js has JavaScript Injection via AST Type Confusion CVSS 3.1CRITICAL 9.8
  • TI-2026-68925 JavaScript injection in Handlebars via own property check bypass CVSS 4.0CRITICAL 9.2
  • TI-2026-26290 Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation CVSS 3.1HIGH 7.5
  • TI-2026-26292 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options CVSS 3.1HIGH 8.3
  • TI-2026-26291 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial CVSS 3.1HIGH 8.1
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences