CVE-2026-106446

A flaw was found in Handlebars. Incomplete validation of pre-parsed AST objects passed to compile() or precompile() allows unchecked AST fields to be emitted into generated JavaScript. An attacker who can supply an object instead of a template string can inject and execute arbitrary JavaScript in the application process.

This flaw has an Important impact. Exploitation requires an application to pass a non-string object (for example, a JSON-deserialized value) to Handlebars.compile() or Handlebars.precompile(). Applications that only pass template strings are not affected. When that unsafe calling pattern is present, injected JavaScript can run with the privileges of the Node.js process. The issue is not Critical for Red Hat scoring because successful exploitation depends on that non-default API usage condition (AC:H), not on typical string-template pipelines alone.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server.