CVE-2026-106446

In Handlebars from 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source in an inline script element, a closing script delimiter can end the element and cause following markup to be parsed and executed.

In Handlebars from 4.0.0 to 4.7.10, lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, they can obtain the Function constructor and execute arbitrary JavaScript with the server application's privileges. Fixed in 4.7.10.

A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows remote code execution (RCE) by injecting malicious JavaScript into generated code. The issue stems from unsanitized `value` fields in `NumberLiteral` AST nodes during template compilation. An attacker can supply a crafted AST object to `Handlebars.compile()`, leading to arbitrary code execution on the server.

A vulnerability in the Handlebars CLI precompiler (versions 4.0.0 through 4.7.8) allows arbitrary JavaScript injection via unsanitized template filenames and CLI arguments. An attacker can execute arbitrary code in Node.js or browser environments when the generated bundle is loaded.

A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows an attacker to achieve remote code execution on the server by injecting a crafted object into the template context. The object bypasses security checks in `resolvePartial()` and causes `env.compile()` to compile malicious JavaScript. The issue is fixed in version 4.7.9.

A vulnerability in Handlebars versions 4.0.0 through 4.7.8 causes a Node.js process crash when processing a template with an unregistered decorator. A TypeError occurs when the runtime attempts to invoke an undefined value as a function.

A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows arbitrary JavaScript execution on the server. The `@partial-block` special variable is stored in the template data context and can be overwritten by helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent `{{> @partial-block}}` invocation compiles and executes that AST, enabling code execution.