{"id":"CVE-2026-106444","aliases":["CLSA-2026-1791806399","CLSA-2026-1791821351","CLSA-2026-1791836630","CLSA-2026-1791837378","DEBIAN-CVE-2026-106444","EUVD-2026-93974","GHSA-xw65-4hp5-5hc7","UBUNTU-CVE-2026-106444"],"status":"published","title":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0029,"percentile":0.21869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2026-10-06T19:01:14Z","modified":"2026-11-11T09:39:20Z","fixes":[{"ecosystem":"npm","package":"handlebars","fixed_in":["4.7.10"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"handlebars","fixed_in":["4.7.8-tuxcare.4","4.5.3-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-handlebars","fixed_in":["3:4.7.10-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.7.9"},{"fixed":"4.7.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.8-tuxcare.0"},{"fixed":"4.7.8-tuxcare.4"}]}],"versions":["4.7.8","4.7.8-tuxcare.1","4.7.8-tuxcare.2","4.7.8-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.3-tuxcare.0"},{"fixed":"4.5.3-tuxcare.2"}]}],"versions":["4.5.3","4.5.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.7-tuxcare.0"},{"fixed":"4.7.7-tuxcare.2"}]}],"versions":["4.7.7","4.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.9-tuxcare.0"},{"fixed":"4.7.9-tuxcare.3"}]}],"versions":["4.7.9","4.7.9-tuxcare.1","4.7.9-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.7.10-1","3:4.7.7+~4.1.0-1","3:4.7.9-1","3:4.7.9-2","3:4.7.9-3","3:4.7.9-4","3:4.7.9-5","3:4.7.9-6"]},{"source":"osv","ecosystem":"Debian:13","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.7.10-1","3:4.7.7+~4.1.0-1","3:4.7.9-1","3:4.7.9-2","3:4.7.9-3","3:4.7.9-4","3:4.7.9-5","3:4.7.9-6"]},{"source":"osv","ecosystem":"Debian:14","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.7.10-1"}]}],"versions":["3:4.7.7+~4.1.0-1","3:4.7.9-1","3:4.7.9-2","3:4.7.9-3","3:4.7.9-4","3:4.7.9-5","3:4.7.9-6"]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.7.10"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-handlebars-assets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.15-2","2:0.20.2-2","2:0.21.0-2","2:0.21.0-3","2:0.21.0-4","2:0.21.0-5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.0.10-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.1.0-1","3:4.5.3-1","3:4.7.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.7.6+~4.1.0-2","3:4.7.7+~4.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.7.7+~4.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-handlebars-assets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:0.23.9+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.7.7+~4.1.0-1","3:4.7.9-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.7.7+~4.1.0-1"]}],"products":[{"vendor":"handlebars-lang","product":"handlebars.js"}],"references":[{"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/handlebars-lang/handlebars.js/pull/2185","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106444.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-106444","tags":["advisory"]},{"url":"https://github.com/handlebars-lang/handlebars.js","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-106444","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106444","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-106444","title":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","status":"published","published":"2026-10-06T19:01:14.626Z","modified":"2026-10-06T19:48:02.05Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:20:04.463704Z"}],"euvd":[{"id":"EUVD-2026-93974","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","status":"published","published":"2026-10-06T19:01:14Z","modified":"2026-10-06T19:48:02Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:36.701921Z"}],"ghsa":[{"id":"GHSA-xw65-4hp5-5hc7","title":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","description":"## Summary\n\n`Handlebars.precompile()` generates JavaScript source that is commonly embedded in browser `\u003cscript\u003e` elements. Before the fix, static template text containing `\u003c/script\u003e` was emitted unchanged. HTML parsers recognize `\u003c/script\u003e` even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed.\n\nThis affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML `\u003cscript\u003e` element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files.\n\n## Details\n\nStatic text is serialized by `quotedString()` in `lib/handlebars/compiler/code-gen.js`. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence `\u003c/script\u003e` terminates the element regardless of JavaScript string context.\n\nOn affected releases, this template:\n\n```handlebars\nsafe\u003c/script\u003e\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e\u003cscript\u003e\n```\n\ncould produce generated source containing:\n\n```js\nreturn 'safe\u003c/script\u003e\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e\u003cscript\u003e';\n```\n\nWhen included inline in an HTML document, the first `\u003c/script\u003e` closes the script containing the precompiled template. The next `\u003cscript\u003e` element is then parsed as HTML and executes.\n\n## Proof of Concept\n\n```js\nconst Handlebars = require('handlebars');\n\nconst template = 'safe\u003c/script\u003e\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e\u003cscript\u003e';\nconst output = Handlebars.precompile(template);\n\nconsole.log(output.includes('\u003c/script\u003e'));\n```\n\nAffected versions print `true`. Embedding `output` directly in an inline `\u003cscript\u003e` element allows the injected script tag to be parsed by the browser.\n\n## Workarounds\n\n- Do not inline precompiled output from untrusted templates into HTML documents.\n- Serve generated precompiled templates as external JavaScript files where practical.\n\n## Credits\n\nReported by Curly-Haired-Baboon Aka Laplas","status":"published","published":"2026-10-08T17:52:37Z","modified":"2026-10-08T17:52:39Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:41:30.097746Z"}],"nvd":[{"id":"CVE-2026-106444","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","status":"published","published":"2026-10-06T20:17:26.13Z","modified":"2026-10-07T13:58:29.527Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:12:54.809359Z"}],"osv":[{"id":"CVE-2026-106444","title":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","status":"published","published":"2026-10-06T19:01:14.626Z","modified":"2026-10-28T02:31:04.164994577Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"DEBIAN-CVE-2026-106444","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","status":"published","published":"2026-10-06T20:17:26.13Z","modified":"2026-10-11T17:00:54.0569452Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"GHSA-xw65-4hp5-5hc7","title":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","description":"## Summary\n\n`Handlebars.precompile()` generates JavaScript source that is commonly embedded in browser `\u003cscript\u003e` elements. Before the fix, static template text containing `\u003c/script\u003e` was emitted unchanged. HTML parsers recognize `\u003c/script\u003e` even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed.\n\nThis affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML `\u003cscript\u003e` element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files.\n\n## Details\n\nStatic text is serialized by `quotedString()` in `lib/handlebars/compiler/code-gen.js`. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence `\u003c/script\u003e` terminates the element regardless of JavaScript string context.\n\nOn affected releases, this template:\n\n```handlebars\nsafe\u003c/script\u003e\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e\u003cscript\u003e\n```\n\ncould produce generated source containing:\n\n```js\nreturn 'safe\u003c/script\u003e\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e\u003cscript\u003e';\n```\n\nWhen included inline in an HTML document, the first `\u003c/script\u003e` closes the script containing the precompiled template. The next `\u003cscript\u003e` element is then parsed as HTML and executes.\n\n## Proof of Concept\n\n```js\nconst Handlebars = require('handlebars');\n\nconst template = 'safe\u003c/script\u003e\u003cscript\u003ealert(\"XSS\")\u003c/script\u003e\u003cscript\u003e';\nconst output = Handlebars.precompile(template);\n\nconsole.log(output.includes('\u003c/script\u003e'));\n```\n\nAffected versions print `true`. Embedding `output` directly in an inline `\u003cscript\u003e` element allows the injected script tag to be parsed by the browser.\n\n## Workarounds\n\n- Do not inline precompiled output from untrusted templates into HTML documents.\n- Serve generated precompiled templates as external JavaScript files where practical.\n\n## Credits\n\nReported by Curly-Haired-Baboon Aka Laplas","status":"published","published":"2026-10-08T17:52:37Z","modified":"2026-10-08T18:00:09.713255773Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"UBUNTU-CVE-2026-106444","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","status":"published","published":"2026-10-06T20:17:00Z","modified":"2026-11-11T09:39:20.132985524Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T10:01:17.870055Z"},{"id":"CLSA-2026-1791806399","title":"TuxCare security update for handlebars (1 CVE)","description":"TuxCare rebuilt handlebars to address 1 CVE. Fixed in 4.7.8-tuxcare.4.","status":"published","published":"2026-10-12T11:59:59Z","modified":"2026-10-15T09:47:40.088887952Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791821351","title":"TuxCare security update for handlebars (1 CVE)","description":"TuxCare rebuilt handlebars to address 1 CVE. Fixed in 4.5.3-tuxcare.2.","status":"published","published":"2026-10-12T16:09:11Z","modified":"2026-10-15T09:47:40.339866646Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791836630","title":"TuxCare security update for handlebars (3 CVEs)","description":"TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 4.7.7-tuxcare.2.","status":"published","published":"2026-10-12T20:23:50Z","modified":"2026-10-15T09:45:52.231078592Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791837378","title":"TuxCare security update for handlebars (2 CVEs)","description":"TuxCare rebuilt handlebars to address 2 CVEs. Fixed in 4.7.9-tuxcare.3.","status":"published","published":"2026-10-12T20:36:18Z","modified":"2026-10-15T09:45:52.233016036Z","updated_at":"2026-11-02T15:43:50.599064Z"}]}}