CVE-2026-106444

About vulnerability

Summary

Handlebars.precompile() generates JavaScript source that is commonly embedded in browser <script> elements. Before the fix, static template text containing </script> was emitted unchanged. HTML parsers recognize </script> even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed.

This affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML <script> element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files.

Details

Static text is serialized by quotedString() in lib/handlebars/compiler/code-gen.js. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence </script> terminates the element regardless of JavaScript string context.

On affected releases, this template:

safe</script><script>alert("XSS")</script><script>

could produce generated source containing:

return 'safe</script><script>alert("XSS")</script><script>';

When included inline in an HTML document, the first </script> closes the script containing the precompiled template. The next <script> element is then parsed as HTML and executes.

Proof of Concept

const Handlebars = require('handlebars');

const template = 'safe</script><script>alert("XSS")</script><script>';
const output = Handlebars.precompile(template);

console.log(output.includes('</script>'));

Affected versions print true. Embedding output directly in an inline <script> element allows the injected script tag to be parsed by the browser.

Workarounds

• Do not inline precompiled output from untrusted templates into HTML documents.
• Serve generated precompiled templates as external JavaScript files where practical.

Credits

Reported by Curly-Haired-Baboon Aka Laplas

Affected product:

Express , Node.js , adobe-spectrum-component-diff-generator , adobe-spectrum-diff-core , adobe-token-diff-generator , aegir , api , appium , aws-cdk , broccoli , broccoli-middleware , codesmith , commit-analyzer , consolidate.js , conventional-changelog , conventional-changelog-cli , conventional-changelog-core , create-instantsearch-app , create-module-federation , create-storybook , create-turbo , create-yarn-workspaces , dmd , documentation , e2b-cli , ember-auto-import , ember-cli , ember.js , embroider-addon-dev , embroider-compat , embroider-core , embroider-vite , epub-maker2 , eslint-plugin-turbo , expo-module-scripts , gatsby , git-raw-commits , git-semver-tags , github , glimmer-analyzer , glimmer-compiler , glimmer-syntax , glimmer-vm , glimmer.js , gulp-conventional-changelog , handlebars , hooks , istanbul , istanbul-reports , jest-preset-angular , jstransformer-handlebars , langchain-classic , lazy-node-semver-ampersand , leafygreen-ui , lerna , lerna-conventional-commits , lg-charts-colors , lg-charts-core , lg-tools-install , lg-tools-storybook-addon , lg-tools-storybook-decorators , lg-tools-storybook-utils , libp2p-interfaces-compliance-tests , microsoft-365-agents-toolkit , modern-js-plugin-polyfill , modern-js-tsconfig , modern.js , module-deps , module-federation-bridge-shared , module-federation-bridge-vue3 , module-federation-core , module-federation-devtools , module-federation-modern-js , module-federation-retry-plugin , module-federation-rsbuild-plugin , newman , novel-epub , npm-init2 , npm-package-json-loader , openapi-typescript-codegen , plop , postman-runtime , release-notes-generator , releaser-tools , rspress , sb , semantic-release , semantic-release-changelog , semantic-release-git , semantic-release-monorepo , semantic-release-npm , semantic-release-plugin-decorators , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-javascript , sentry-nitro , sentry-node-native , sentry-replay , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , shifter , standard-changelog , standard-version , storybook , storybook-addon-a11y , storybook-addon-actions , storybook-addon-backgrounds , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-highlight , storybook-addon-interactions , storybook-addon-links , storybook-addon-measure , storybook-addon-onboarding , storybook-addon-outline , storybook-addon-themes , storybook-addon-toolbars , storybook-addon-viewport , storybook-angular , storybook-blocks , storybook-builder-manager , storybook-builder-vite , storybook-builder-webpack5 , storybook-channel-postmessage , storybook-channels , storybook-cli , storybook-client-logger , storybook-codemod , storybook-components , storybook-core , storybook-core-client , storybook-core-common , storybook-core-events , storybook-core-server , storybook-core-webpack , storybook-csf-plugin , storybook-csf-tools , storybook-docs-tools , storybook-ember , storybook-html , storybook-html-vite , storybook-html-webpack5 , storybook-instrumenter , storybook-manager , storybook-manager-api , storybook-nextjs , storybook-node-logger , storybook-preact , storybook-preact-vite , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-preset-html-webpack , storybook-preset-preact-webpack , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-preset-svelte-webpack , storybook-preset-vue3-webpack , storybook-preview , storybook-preview-api , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-router , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-telemetry , storybook-theming , storybook-types , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi , strapi-admin , strapi-content-releases , strapi-content-type-builder , strapi-core , strapi-data-transfer , strapi-email , strapi-generators , strapi-permissions , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-upload-aws-s3 , strapi-strapi , strapi-types , strong-error-handler , testem , ts-jest , turbo-gen , turbo-types , typedoc , typedoc-plugin-markdown , verdaccio , verdaccio-auth , verdaccio-loaders , verdaccio-logger , verdaccio-signature , verdaccio-ui-theme , verdaccio-utils , web-storybook-builder , ws-pkg-list , ws-yarn-workspaces , yarn-tool-changelog , yarn-tool-dotenv , yarn-tool-fix-all , yarn-tool-fix-ws-links , yarn-tool-fix-ws-pkgs-link , yarn-tool-fix-ws-versions , yarn-tool-get-pkg-bin , yarn-tool-ncu , yarn-tool-npa-to-deps , yarn-tool-npa-to-deps-query , yarn-tool-pkg-deps-add , yarn-tool-pkg-deps-util , yarn-tool-pkg-entry-util , yarn-tool-pkg-hosted-info , yarn-tool-pkg-name-to-types , yarn-tool-pkg-version-query , yarn-tool-resolve-package , yarn-tool-sort-lerna-json , yarn-tool-tag , yarn-tool-version-recommended , yarn-tool-workspaces-project , yarn-tool-ws-scope , yarn-tool-yarnlock , yarn-tool-yarnlock-entries , yarn-tool-yarnlock-fs , yarn-tool-yarnlock-parse , yarn-tool-yarnlock-util

Affected packages:

handlebars @ 4.7.9 (+2481 more)