Ember Dynamic Render Template
Monthly
Client-side template injection in ember-dynamic-render-template exposes Ember.js applications to cross-site scripting when the render-template component receives attacker-controlled data through its templateString property. The addon's render-template.js passes templateString directly to Ember/Glimmer's compileTemplate() with no sanitization, allowlisting, or validation, causing the runtime to compile and execute arbitrary Handlebars expressions in the victim's browser. All published versions are affected per the CPE wildcard; no CISA KEV confirmation exists and no public exploit code has been identified at time of analysis.
Client-side template injection in ember-dynamic-render-template exposes Ember.js applications to cross-site scripting when the render-template component receives attacker-controlled data through its templateString property. The addon's render-template.js passes templateString directly to Ember/Glimmer's compileTemplate() with no sanitization, allowlisting, or validation, causing the runtime to compile and execute arbitrary Handlebars expressions in the victim's browser. All published versions are affected per the CPE wildcard; no CISA KEV confirmation exists and no public exploit code has been identified at time of analysis.