CVE-2026-106444
Fixed in a distro release EPSS <1%CVSS 4.7
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
Products: handlebars-lang handlebars.js
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | handlebars | 4.7.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-jess | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-assets-fips-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.5 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | kibana-8.19 | 8.19.23-r3 |
| Chainguard | kibana-8.19-bitnami | 8.19.23-r3 |
| Chainguard | kibana-9.2 | no fix |
| Chainguard | kibana-9.3 | no fix |
| Chainguard | kibana-9.4 | 9.4.7-r8 |
| Chainguard | kibana-9.5 | 9.5.4-r7 |
| Chainguard | langfuse-4-worker | 4.56.0-r0 |
| Chainguard | langfuse-fips-4-worker | 4.49.0-r5 |
| Chainguard | lerna | 10.0.1-r10 |
| Chainguard | librechat | 0.8.8-r2 |
| Chainguard | nextcloud-server-33 | 33.0.9-r7 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r28 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.6-r14 |
| Chainguard | opensearch-dashboards-3 | 3.8.0-r13 |
| Chainguard | opensearch-dashboards-3-fips | 3.8.0-r8 |
| Chainguard | pelias-api | 7.11.0-r2 |
| Chainguard | prism | 5.16.0-r16 |
| Chainguard | rancher-api-ui | 1.2.3-r15 |
| Chainguard | renovate | 44.133.0-r5 |
| Chainguard | tileserver-gl | 5.6.0-r20 |
| Chainguard | tileserver-gl-fips | 5.6.0-r19 |
| Chainguard | ts-patch | 4.0.1-r48 |
| Chainguard | verdaccio | 6.10.5-r4 |
| Chainguard | wazuh-dashboard | 4.14.8-r9 |
| Chainguard | wazuh-dashboard-dashboards-reporting | 4.14.8-r9 |
| Chainguard | wazuh-dashboard-dashboards-reporting-fips | 4.14.8-r9 |
| Chainguard | wazuh-dashboard-fips | 4.14.8-r9 |
| Chainguard | wazuh-dashboard-security-plugin | 4.14.8-r9 |
| Chainguard | wazuh-dashboard-security-plugin-fips | 4.14.8-r9 |
| Debian 12 | node-handlebars | no fix |
| Debian 13 | node-handlebars | no fix |
| Debian 14 | node-handlebars | 3:4.7.10-1 |
| Ubuntu 16.04 LTS | ruby-handlebars-assets | no fix |
| Ubuntu 18.04 LTS | node-handlebars | no fix |
| Ubuntu 18.04 LTS | ruby-handlebars-assets | no fix |
| Ubuntu 20.04 LTS | node-handlebars | no fix |
| Ubuntu 20.04 LTS | ruby-handlebars-assets | no fix |
| Ubuntu 22.04 LTS | node-handlebars | no fix |
| Ubuntu 22.04 LTS | ruby-handlebars-assets | no fix |
| Ubuntu 24.04 LTS | node-handlebars | no fix |
| Ubuntu 24.04 LTS | ruby-handlebars-assets | no fix |
| Ubuntu 26.04 LTS | node-handlebars | no fix |
| Ubuntu 26.10 | node-handlebars | no fix |
| Wolfi | lerna | 10.0.1-r10 |
| Wolfi | nextcloud-server-33 | 33.0.9-r7 |
| Wolfi | opensearch-dashboards-3 | 3.8.0-r13 |
| Wolfi | prism | 5.16.0-r16 |
| Wolfi | rancher-api-ui | 1.2.3-r15 |
| Wolfi | renovate | 44.133.0-r5 |
| Wolfi | tileserver-gl | 5.6.0-r20 |
| Wolfi | ts-patch | 4.0.1-r48 |