Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106444— Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Quick assessment

Affected
handlebars-lang handlebars.js
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Handlebars 提供了强大的功能，使用户能够构建语义化模板。在版本 4.0.0 到 4.7.10 之间，Handlebars.precompile() 函数使用 lib/handlebars/compiler/code-gen.js 中的 quotedString() 方法，在生成的 JavaScript 代码中直接嵌入静态模板文本，而未对可能终止外部 HTML 元素的特殊序列进行转义。当应用程序预编译由攻击者控制的模板文本，并将生成的源代码直接嵌入到内联 元素中时，闭合的脚本结束标记可能会中断该元素，导致后

CVSS 4.7 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
handlebars-lang handlebars.js >= 4.0.0, < 4.7.10 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106444

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Source: CVE Program / CVE List V5
Vulnerability Description
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
handlebars-lang handlebars.js >= 4.0.0, < 4.7.10 -

II. Public POCs for CVE-2026-106444

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106444

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-106444 (2)

Vendor Advisories for CVE-2026-106444 (1)

Vendor Pages for CVE-2026-106444 (1)

Same Patch Batch · handlebars-lang · 2026-10-06 · 3 CVEs total

CVE-2026-106446 9.8 CRITICAL Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
CVE-2026-106445 9.2 CRITICAL Handlebars: JavaScript Injection via Own Property Check Bypass

IV. Related Vulnerabilities

Same product: handlebars.js
Same vendor: handlebars-lang
Same weakness: CWE-116

V. Comments for CVE-2026-106444

No comments yet

Leave a comment