CVE-2026-106446: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
Handlebars.compile() and Handlebars.precompile() accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked.
If an application passes an untrusted object to compile() or precompile(), such as a parsed JSON request body, that object can carry arbitrary JavaScript. With compile(), the code runs on the server when the template renders. With precompile(), it ends up in the precompiled output and runs wherever that output is loaded.
Applications that only ever pass template strings are not affected.
This bypasses the AST validation added in 4.7.9 for GHSA-2w6w-674q-4c4q, GHSA-xhpv-hc6g-r9c6 and GHSA-3mfm-83xf-c92r.
References
- github.com/advisories/GHSA-8r5x-fm3f-whwj
- github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2
- github.com/handlebars-lang/handlebars.js/pull/2185
- github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10
- github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj
- nvd.nist.gov/vuln/detail/CVE-2026-106446
Code Behaviors & Features
Detect and mitigate CVE-2026-106446 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →