CVE-2026-106444

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106444

EUVD

EUVD-2026-93974

Affected Vendors & Products

Vendor	Product	Version / Range
handlebars-lang	handlebars.js	>= 4.0.0, < 4.7.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability affects Handlebars versions 4.0.0 to 4.7.10. It involves the Handlebars.precompile() function improperly escaping sequences in static template text when generating JavaScript code. This can allow attackers to break out of a script tag and inject malicious code if attacker-controlled templates are precompiled and embedded directly in inline scripts.

Detection Guidance

This vulnerability affects Handlebars versions 4.0.0 to 4.7.9. To detect it, check the installed version of Handlebars in your project using commands like 'npm list handlebars' or 'npm ls handlebars'. If the version is within the affected range, the system is vulnerable.

Impact Analysis

If you use Handlebars versions 4.0.0 to 4.7.9 and precompile attacker-controlled templates for inline scripts, an attacker could execute arbitrary JavaScript in the context of your application. This could lead to data theft, session hijacking, or other malicious actions. External scripts or server-side rendering are not affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it relates to a specific JavaScript templating engine (Handlebars) and does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Handlebars to version 4.7.10 or later immediately. If using npm, run 'npm update handlebars' or specify the fixed version in your package.json. Avoid embedding precompiled templates directly in inline script elements to prevent execution of malicious markup.

Hi! I’m here to help you understand CVE-2026-106444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70