GHSA-XW65-4HP5-5HC7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Summary Handlebars.precompile generates JavaScript source that is commonly embedded in browser elements. Before the fix, static template text containing was emitted unchanged. HTML parsers recognize even inside a JavaScript string literal, closing the surrounding script element and allowing...

EUVD-2026-93974

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates...

CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

Cross-site Scripting (XSS)

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the quotedString function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that Handlebars.precompi...

CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

Cross-site Scripting (XSS)

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the quotedString function in lib/handlebars/compiler/code-gen.js, which writes static template text into the JavaScript that...

CVE-2026-106444: Improper Encoding or Escaping of Output

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...

PT-2026-107116

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.9 Description The Handlebars.precompile function uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an...

Arduino JSON 'extractFrom' function denial of service vulnerability

Arduino JSON is a JSON library that runs on embedded systems. A security vulnerability in the 'extractFrom' function in the Internals/QuotedString.cpp script for Arduino JSON allows a remote attacker to submit a JSON string with a special termination character followed by the ' \ ' character afte...