Handlebars CVE-2026-106444

Exploitation requires a specific, non-default integration: the application must (1) accept attacker-controlled Handlebars template text, (2) run Handlebars.precompile() on that untrusted text, and (3) embed the generated source directly inside an INLINE <script> element in an HTML page delivered to victims, who must then (4) load that page (UI:R). The description explicitly states ordinary server-side rendering and precompiled templates served as EXTERNAL JavaScript files are NOT affected - these are the common usage patterns, which is why real-world exposure is limited. Vulnerable versions are 4.0.0 through 4.7.9; 4.7.10 is fixed. The combination of untrusted-template precompilation into inline scripts plus required victim interaction are the primary limiting factors that keep practical risk well below a typical network XSS.

This is a genuine XSS/output-encoding flaw (CWE-116) but a comparatively low real-world priority, and the signals are consistent in pointing that way. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7, Medium) already encodes the key limiters: High attack complexity and required user interaction, reflecting that exploitation only occurs in a narrow, non-default integration pattern. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV and no public exploit code was supplied in the intelligence, so this is 'no public exploit identified at time of analysis.' The AC:H and the description's explicit carve-outs (ordinary server-side rendering and externally-served precompiled .js files are NOT affected) mean most Handlebars deployments are unaffected even though the library itself is extremely widespread - a classic case of a ubiquitous component with a tightly scoped vulnerable configuration. No conflicting signals were found between the vector and the description; both agree the issue is network-reachable but conditional and user-interaction-gated. Bottom line: patch in the normal maintenance cycle, prioritize only if your application precompiles untrusted template text into inline scripts.

An application accepts user-supplied Handlebars template text, calls Handlebars.precompile() on it server-side, and inlines the generated JavaScript directly into an inline <script> element of a served HTML page. An attacker submits template text containing a '</script>' sequence followed by markup; when a victim loads the page, the injected delimiter closes the script element early and the attacker's trailing markup is parsed and executed in the victim's browser. No public exploit code was identified, and High attack complexity reflects the unusual integration required.