The vulnerability exists in the render-template component of the ember-dynamic-render-template addon (addon/components/render-template.js). It directly forwards its property to Ember/Glimmer's compileTemplate function from @ember/template-compilation without performing any input sanitization, allow-listing, or validation. This behavior corresponds to CWE-1336, indicating unsafe template compilation that could lead to security issues such as injection or unauthorized code execution. The CVSS 3.1 score is 6.1 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

The vulnerability allows an attacker to influence the template compilation process by providing unsanitized input to the compileTemplate function. This can lead to partial compromise of confidentiality and integrity within the affected application scope. The attack requires user interaction and can be performed remotely without privileges. There is no reported impact on availability. No active exploitation is known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid passing untrusted input to the render-template component or implement their own input validation and sanitization before usage. Monitor vendor channels for updates or patches addressing this issue.