CVE-2026-106444: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Handlebars.precompile() generates JavaScript source that is commonly embedded in browser <script> elements. Before the fix, static template text containing </script> was emitted unchanged. HTML parsers recognize </script> even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed.
This affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML <script> element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files.
References
- github.com/advisories/GHSA-xw65-4hp5-5hc7
- github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725
- github.com/handlebars-lang/handlebars.js/pull/2185
- github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10
- github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7
- nvd.nist.gov/vuln/detail/CVE-2026-106444
Code Behaviors & Features
Detect and mitigate CVE-2026-106444 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →