CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Attacker can execute arbitrary JavaScript if precompiled templates are embedded inline without proper escaping, affecting applications using Handlebars.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-106444?
CVE-2026-106444 is a medium-severity cross-site scripting vulnerability in handlebars-lang handlebars.js, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
Weakness: CWE-116
Which versions are affected by CVE-2026-106444?
2 open source packages ship an affected version, including handlebars.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | From 4.0.0 | 4.7.10 |
handlebars npm | From 4.0.0 | 4.7.10 |
How do I fix CVE-2026-106444?
Upgrade handlebars to 4.7.10 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-106444 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106444 exists.
Sources
Also known as CLEANSTART-2026-ZV74526, CLSA-2026-1791806399, CLSA-2026-1791821351, DEBIAN-CVE-2026-106444, ECHO-6434-f033-74ec, GHSA-xw65-4hp5-5hc7 and 12 more.