CVE-2026-71286
Received Received - Intake

Client-Side Template Injection in ember-dynamic-render-template

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its `templateString` property directly into Ember/Glimmer's compileTemplate() (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input. Because compileTemplate() dynamically compiles and renders the supplied string as a live Handlebars/Glimmer template, any application that renders attacker-influenced data through this component's templateString property is exposed to client-side template injection: an attacker-controlled Handlebars expression is compiled and executed in the context of the rendering component, which can be leveraged for cross-site scripting depending on what helpers/context are exposed to the compiled template.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71286
EUVD
EUVD-2026-53371

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ember dynamic_render_template *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a client-side template injection flaw in the ember-dynamic-render-template addon. The render-template component passes user-controlled input directly into Ember/Glimmer's compileTemplate() without sanitization. This allows attackers to inject malicious Handlebars expressions via the templateString property, which are then compiled and executed in the application's context. This can lead to cross-site scripting (XSS) if the application exposes dangerous helpers or context to the template.

Detection Guidance

To detect this vulnerability, inspect your Ember.js applications for usage of the ember-dynamic-render-template addon, particularly the render-template component. Check if the templateString property is populated with user-controlled input without sanitization. Review application logs for unexpected Handlebars/Glimmer template execution or XSS-like behavior.

Impact Analysis

If your application uses the vulnerable ember-dynamic-render-template component and renders attacker-controlled data through the templateString property, an attacker could execute arbitrary JavaScript in the context of your application. This could allow them to steal sensitive data, perform actions on behalf of users, or deface your application. The impact depends on the application's functionality and exposed Handlebars helpers.

Compliance Impact

This vulnerability could lead to data breaches by enabling attackers to steal user data or session tokens, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using this component may face compliance violations, regulatory fines, and reputational damage if exploited.

Mitigation Strategies

Immediately remove or replace the ember-dynamic-render-template addon from your project. If dynamic template rendering is required, implement strict input validation and use a sanitization library to whitelist allowed template syntax. Ensure templateString is never populated with untrusted user input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart