CVE-2026-106446: CWE-94: Improper Control of Generation of Code ('Code Injection') in handlebars-lang handlebars.js

Handlebars.js versions 4.0.0 to 4.7.9 contain a code injection vulnerability (CWE-94) due to improper control of code generation. The functions Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects but only validate certain PathExpression, NumberLiteral, and BooleanLiteral values. This incomplete validation allows an attacker who can supply an object instead of a template string to inject malicious JavaScript expressions into unchecked AST fields such as Program.blockParams.length, non-PathExpression parameter depth, non-string StringLiteral.value, or non-string PathExpression.original. The injected code is emitted into the generated JavaScript, resulting in code execution in the server process during template rendering or precompile output loading. Applications that only pass template strings are not affected. The issue was addressed and fixed in version 4.7.10.

Successful exploitation allows an unauthenticated attacker who can supply a crafted object instead of a template string to achieve remote code execution on the server process running Handlebars.js. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating high severity with network attack vector, no privileges required, and no user interaction needed.

Upgrade handlebars.js to version 4.7.10 or later, where this vulnerability is fixed. Applications that only pass template strings to Handlebars.compile() or Handlebars.precompile() are not affected. There are no other mitigations noted. Patch status is confirmed fixed in 4.7.10.