The render-template component of ember-dynamic-render-template (addon/components/render-template.js) directly passes its templateString property to Ember/Glimmer's compileTemplate() function without any input sanitization, allow-listing, or validation. Since compileTemplate() dynamically compiles and renders the provided string as a live Handlebars/Glimmer template, any attacker-influenced data rendered through this property can result in client-side template injection. This vulnerability enables an attacker to execute arbitrary Handlebars expressions in the context of the rendering component, which can be leveraged for cross-site scripting attacks depending on the available helpers and context exposed to the template.

An attacker who can influence the templateString property can inject and execute arbitrary Handlebars expressions client-side. This can lead to cross-site scripting (XSS) vulnerabilities, potentially allowing theft of user data, session hijacking, or other malicious actions within the context of the vulnerable application. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid rendering untrusted or attacker-controlled data through the templateString property of the render-template component. Implement input validation, sanitization, or allow-listing on any data passed to this property to prevent injection of malicious template code.