CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...