CVE-2026-106444: CWE-116: Improper Encoding or Escaping of Output in handlebars-lang handlebars.js

Handlebars.js versions from 4.0.0 up to but not including 4.7.10 contain a CWE-116 vulnerability due to improper escaping in Handlebars.precompile(). Specifically, the function uses quotedString() to emit static template text into generated JavaScript without escaping sequences that can terminate an enclosing HTML script element. If an application precompiles attacker-controlled template text and embeds the generated source directly inside an inline script element, an attacker can inject a closing script delimiter, causing subsequent attacker-controlled markup to be parsed and executed. Server-side rendering and precompiled templates served as external JavaScript files are not affected. The vulnerability is fixed in version 4.7.10.

This vulnerability allows an attacker to inject script code by terminating an inline script element prematurely when attacker-controlled templates are precompiled and embedded inline. This can lead to cross-site scripting (XSS) with limited impact (confidentiality and integrity impact rated low, availability not affected). There are no known exploits in the wild.

Upgrade handlebars.js to version 4.7.10 or later, where this issue is fixed. Avoid embedding precompiled templates generated from untrusted input directly inside inline script elements. Using server-side rendering or serving precompiled templates as external JavaScript files mitigates this issue.