{"schema":"threatline.record/2","record":{"id":"CVE-2026-106444","aliases":["GHSA-xw65-4hp5-5hc7"],"summary":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","details":"## Summary\n\n`Handlebars.precompile()` generates JavaScript source that is commonly embedded in browser `<script>` elements. Before the fix, static template text containing `</script>` was emitted unchanged. HTML parsers recognize `</script>` even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed.\n\nThis affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML `<script>` element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files.\n\n## Details\n\nStatic text is serialized by `quotedString()` in `lib/handlebars/compiler/code-gen.js`. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence `</script>` terminates the element regardless of JavaScript string context.\n\nOn affected releases, this template:\n\n```handlebars\nsafe</script><script>alert(\"XSS\")</script><script>\n```\n\ncould produce generated source containing:\n\n```js\nreturn 'safe</script><script>alert(\"XSS\")</script><script>';\n```\n\nWhen included inline in an HTML document, the first `</script>` closes the script containing the precompiled template. The next `<script>` element is then parsed as HTML and executes.\n\n## Proof of Concept\n\n```js\nconst Handlebars = require('handlebars');\n\nconst template = 'safe</script><script>alert(\"XSS\")</script><script>';\nconst output = Handlebars.precompile(template);\n\nconsole.log(output.includes('</script>'));\n```\n\nAffected versions print `true`. Embedding `output` directly in an inline `<script>` element allows the injected script tag to be parsed by the browser.\n\n## Workarounds\n\n- Do not inline precompiled output from untrusted templates into HTML documents.\n- Serve generated precompiled templates as external JavaScript files where practical.\n\n## Credits\n\nReported by Curly-Haired-Baboon Aka Laplas","categories":["Libraries & packages"],"product":"handlebars","vendor":"handlebars-lang","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","source_modified_at":"2026-10-08T17:52:39Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"handlebars"},"range":">= 4.0.0, <= 4.7.9"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106444","source_modified_at":"2026-10-06T19:48:02.050Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"handlebars.js","vendor":"handlebars-lang","versions":[{"status":"affected","version":">= 4.0.0, < 4.7.10"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xw65-4hp5-5hc7","source_modified_at":"2026-10-08T18:00:09.713255773Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"handlebars","ecosystem":"npm","purl":"pkg:npm/handlebars"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.7.10"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","source_modified_at":"2026-10-08T17:52:39Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"handlebars"},"version":"4.7.10"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xw65-4hp5-5hc7","source_modified_at":"2026-10-08T18:00:09.713255773Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"handlebars","ecosystem":"npm","purl":"pkg:npm/handlebars"},"version":"4.7.10"}],"cvss":4.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00294,"percentile":0.2095,"score_date":"2026-10-23"},"published_at":"2026-10-06T19:01:14.626Z","modified_at":"2026-10-08T18:00:09.713255773Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T17:52:39Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106444","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T19:48:02.050Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-xw65-4hp5-5hc7","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T18:00:09.713255773Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106444","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/handlebars-lang/handlebars.js/pull/2185","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T19:47:42.547607Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-08T18:00:09.713255773Z","content_hash":"71a45cabe2fb6b8926dbe8fcbca00295f6a1442d79e8b2d2f54d11b85655a2ae"}}