{"id":"EUVD-2026-93974","enisaUuid":"fd5823db-a127-381c-95e8-5815a0123338","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","datePublished":"Oct 6, 2026, 7:01:14 PM","dateUpdated":"Oct 6, 2026, 7:48:02 PM","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7\nhttps://github.com/handlebars-lang/handlebars.js/pull/2185\nhttps://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725\nhttps://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10\n","aliases":"CVE-2026-106444\nGHSA-xw65-4hp5-5hc7\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"239ccb86-f41d-3d9d-89fe-4e6a0bf1e098","product":{"name":"handlebars.js","vendor":{"name":"handlebars-lang"}},"product_version":"4.0.0, \u003c 4.7.10"}],"enisaIdVendor":[{"id":"ee3f1ad7-7ca9-3e41-9cf1-83d971d25ad1","vendor":{"name":"handlebars-lang"}}],"enisaIdVulnerability":[{"id":"56999e45-ece6-3aa1-a2a8-090564bdf0b0","vulnerability":{"id":"GHSA-xw65-4hp5-5hc7","description":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","datePublished":"Oct 8, 2026, 5:52:37 PM","dateUpdated":"Oct 8, 2026, 5:52:37 PM","baseScore":0.0,"references":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106444\nhttps://github.com/handlebars-lang/handlebars.js/pull/2185\nhttps://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725\nhttps://github.com/handlebars-lang/handlebars.js\nhttps://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10\n","enisa_id":"EUVD-2026-93974\n","aliases":"GHSA-xw65-4hp5-5hc7\nCVE-2026-106444\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8575df34-e8e1-343f-aef7-5f20dea1f24a","vulnerability":{"id":"CVE-2026-106444","description":"Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.","datePublished":"Oct 6, 2026, 7:01:14 PM","dateUpdated":"Oct 6, 2026, 7:48:02 PM","status":"PUBLISHED","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7\nhttps://github.com/handlebars-lang/handlebars.js/pull/2185\nhttps://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725\nhttps://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10\n","enisa_id":"EUVD-2026-93974\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 4, 2026, 7:15:51 AM","vulnerabilityProduct":[{"id":"708aefdf-303f-35d0-866e-0bc4a631d0fd","product":{"name":"handlebars.js","vendor":{"name":"handlebars-lang"}},"product_version":"4.0.0, \u003c 4.7.10"}],"vulnerabilityVendor":[{"id":"063e57ad-3508-3687-8f71-115a45149495","vendor":{"name":"handlebars-lang"}}]}}],"enisaIdAdvisory":[]}