EUVD-2026-53371
GHSA-pvmf-8hpv-qh7r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requiring victim page load (UI:R); injected template executes across browser security boundary (S:C); attacker needs no privileges, only ability to influence templateString input (PR:N).
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its templateString property directly into Ember/Glimmer's compileTemplate() (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input. Because compileTemplate() dynamically compiles and renders the supplied string as a live Handlebars/Glimmer template, any application that renders attacker-influenced data through this component's templateString property is exposed to client-side template injection: an attacker-controlled Handlebars expression is compiled and executed in the context of the rendering component, which can be leveraged for cross-site scripting depending on what helpers/context are exposed to the compiled template.
AnalysisAI
Client-side template injection in ember-dynamic-render-template exposes Ember.js applications to cross-site scripting when the render-template component receives attacker-controlled data through its templateString property. The addon's render-template.js passes templateString directly to Ember/Glimmer's compileTemplate() with no sanitization, allowlisting, or validation, causing the runtime to compile and execute arbitrary Handlebars expressions in the victim's browser. All published versions are affected per the CPE wildcard; no CISA KEV confirmation exists and no public exploit code has been identified at time of analysis.
Technical ContextAI
ember-dynamic-render-template is an Ember.js community addon by miguelcobain (CPE: cpe:2.3:a:miguelcobain:ember-dynamic-render-template:*) that exposes a Glimmer component designed to compile and render dynamic template strings at runtime. The vulnerable logic in addon/components/render-template.js forwards the templateString property without modification into @ember/template-compilation's compileTemplate() function. CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) precisely describes this root cause: attacker-supplied input reaches a template engine interpreter without neutralization, enabling injection of executable Handlebars and Glimmer expressions. Because compileTemplate() operates entirely client-side in the browser, injected expressions execute within the security context of the rendering page, with access to whatever helpers, services, and component state are exposed to the compiled template at render time.
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis - available references point only to the upstream GitHub repository with no tagged release, changelog entry, or advisory confirming a fix. The primary and most effective workaround is to eliminate the vulnerable data flow entirely: audit all uses of the render-template component and ensure that templateString is never populated from user-supplied sources such as URL parameters, query strings, form inputs, or database-stored user content; this removes the attack surface with no functional side effects for applications that only render developer-controlled strings. If truly dynamic template compilation from external input is a product requirement, consider replacing the addon with a custom implementation that validates templateString against a strict allowlist of permitted Handlebars helpers and structural patterns before passing to compileTemplate(), rejecting any input containing unknown or executable expressions. As a defense-in-depth measure, a Content Security Policy that blocks inline script execution can reduce the practical impact of any injected payload in browsers that enforce it, though this does not prevent template compilation itself. Monitor the upstream repository for patch releases and subscribe to GitHub release notifications.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
Share
External POC / Exploit Code
Leaving vuln.today