CVE-2026-106446: Handlebars.js: JavaScript Injection via AST Validation Bypass in compile

Overview

The record describes Handlebars as a tool for building semantic templates. The issue affects Handlebars.compile() and Handlebars.precompile() when they receive pre-parsed AST objects instead of template strings. According to the record, these functions validate only selected node values, and the bypass circumvents the AST validation added in 4.7.9 for CVE-2026-33937. The advisory is tracked as GHSA-8r5x-fm3f-whwj.

Impact

The weakness is classified as CWE-94 (Code Injection). The record states that unchecked values can be emitted into generated JavaScript, which may cause code execution in the server process when compile output is rendered or when precompile output is loaded. The NVD scoring in the record is critical (9.8), with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.

Affected products and versions

• Product: Handlebars-lang Handlebars.js
• Range in the record: from 4.0.0 up to before 4.7.10
• Per the record, applications that pass only template strings are not affected.
• The record lists no entries in its fixes field, but the description states the issue is fixed in 4.7.10.

Exploitation status

The CISA KEV entry is not listed in the record, so no confirmed active exploitation can be stated from it. No confirmed exploitation appears in the sources consulted. The SSVC field in the record reports exploitation as poc, which indicates a proof-of-concept level and not confirmed exploitation in the wild. The EPSS probability in the record is 0.0064 with a percentile of 0.50067, dated 2026-10-23.

Remediation and mitigation

• Upgrade Handlebars.js to 4.7.10, which the record identifies as the fixed release. Review the release notes for details.
• Until upgrading, do not pass AST objects or other non-string input from untrusted sources to compile or precompile. Accept only template strings from users.
• Load precompiled templates only from trusted and integrity-checked sources, since the record states precompile output can trigger the issue when loaded.
• Maintain an inventory of Handlebars dependencies, including transitive ones, to identify affected versions.

Detection guidance

• Search codebases for calls to compile or precompile that receive values other than plain strings, especially those built from user-controlled data.
• Review pipelines that load precompiled template artifacts and confirm their origin.
• Monitor server processes for unexpected child processes or unusual behavior after template rendering, as a defensive signal of possible code execution.

Limitations of the available information

The record does not include a fixed version list in its fixes field, so the fixed release is taken from the description. The commit and pull request referenced in the record were not analyzed in detail here. The record contains no additional technical detail on exploitation and has the status Awaiting Analysis. Whether a given deployment is exposed depends on whether it passes non-string input to these functions, which the record does not assess.

Frequently asked questions

Which Handlebars.js versions are affected?

The record places the affected range from 4.0.0 up to before 4.7.10, and states the issue is fixed in 4.7.10.

Does my application need to change if it only uses template strings?

According to the record, applications that pass only template strings to these functions are not affected by this issue.

Is this CVE known to be exploited in the wild?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.