CVE-2026-106444: Handlebars JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
Summary
CVE-2026-106444: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates. Affects handlebars versions >= 4.0.0, < 4.7.10. Fixed in 4.7.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Handlebars is a popular templating engine for JavaScript that allows developers to create dynamic HTML content by embedding expressions within templates. It is widely used in web applications to separate HTML generation from application logic, enhancing maintainability and readability. However, a vulnerability has been identified in versions prior to 4.7.10, where unsafe inline embedding of precompiled templates can lead to JavaScript injection attacks.
Vulnerability Detail
The vulnerability arises from the way Handlebars precompiles templates. The method Handlebars.precompile() generates JavaScript source code that can be embedded directly in HTML <script> elements. If the static template text includes the sequence </script>, it can prematurely terminate the script element, allowing attacker-controlled markup to be executed. This issue is particularly dangerous when untrusted templates are precompiled and embedded directly into HTML, as it can lead to cross-site scripting (XSS) attacks.
How To Fix
Latest published version: 4.7.10 as of 22 Oct 2026
npm install handlebars@4.7.10The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid inlining precompiled output from untrusted templates into HTML documents. Instead, serve generated precompiled templates as external JavaScript files where practical. For example, you can save the precompiled template in a separate JavaScript file and include it in your HTML like this: <script src='path/to/precompiled-template.js'></script>.
Conclusion
The vulnerability identified as CVE-2026-106444 in Handlebars poses a risk of JavaScript injection through unsafe inline embedding of precompiled templates. It is crucial for developers using affected versions to update to 4.7.10 or later to mitigate this risk. Implementing workarounds can also help reduce exposure until an update can be applied.
See every vulnerability recorded for handlebars →
FAQ
The vulnerability has a CVSS score of 4.7, indicating a moderate severity level.
Versions of Handlebars prior to 4.7.10 are affected by this vulnerability.
This vulnerability can facilitate cross-site scripting (XSS) attacks, allowing attackers to execute arbitrary JavaScript in the context of the user's browser.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup at Vulert Scanner.
If you cannot update Handlebars immediately, implement the recommended workarounds by avoiding inline embedding of untrusted templates and serving precompiled templates as external JavaScript files.
References
Related vulnerabilities
Recent vulnerabilities recorded for handlebars.
