CVE-2026-106444
Description
A flaw was found in Handlebars. This vulnerability allows a remote attacker to execute arbitrary script code through Cross-Site Scripting (XSS). When an application precompiles untrusted template text and embeds the generated output directly into an inline web script block, static content is not properly escaped for closing script tags. An attacker can craft a template that prematurely closes the script container, allowing injected malicious markup to run in the victim's browser session.
Statement
A moderate severity cross-site scripting (XSS) flaw was found in the Handlebars JavaScript template library. When serializing static template text into generated JavaScript, Handlebars.precompile() does not escape sequences that terminate an enclosing HTML script element. An application that precompiles attacker-controlled template text and embeds the generated source directly in an inline HTML script element can be attacked by a template containing a closing script tag delimiter: the enclosing script element is terminated early, and the attacker-controlled markup that follows is parsed and executed in the victim's browser session. Exploitation requires this specific usage pattern together with user interaction; ordinary server-side rendering of Handlebars templates, and precompiled templates delivered as external JavaScript files, are not affected. Red Hat rates this flaw Moderate impact (CVSS 4.7, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), consistent with the upstream rating. Within the Red Hat portfolio, this flaw is tracked against components of the hummingbird-1 update stream (Red Hat Hardened Images), where the Handlebars npm package appears as a dependency in component sources. These affects are delegated to the Hummingbird business unit, whose assessment resolved them as not affected because the vulnerable component is not present.
Mitigation
This flaw can be avoided without upgrading: do not embed precompiled output from untrusted or attacker-controlled Handlebars templates directly in inline HTML script elements. Where practical, serve generated precompiled templates as external JavaScript files, or rely on ordinary server-side rendering, since those usage patterns are not affected. Restricting template precompilation to trusted template sources also prevents attacker-controlled template text from reaching Handlebars.precompile(). Updating Handlebars to the upstream fixed version (4.7.10) also resolves this issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 4.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
