CVE-2026-106444

Executive Summary

CVE-2026-106444 is a cross-site scripting (XSS) vulnerability in Handlebars, a popular semantic templating library, affecting versions 4.0.0 through 4.7.9. The flaw arises because Handlebars.precompile() fails to escape sequences in static template text that can terminate an enclosing HTML <script> element, allowing an attacker who controls precompiled template content to break out of an inline script context and inject executable markup. Exploitation requires the specific deployment pattern of precompiling attacker-controlled template text and embedding the generated JavaScript directly into an inline <script> block, making it a contextual risk rather than a universal one; regular server-side rendering and externally served precompiled templates are unaffected.

Technical Analysis

The vulnerability resides in the template precompilation pipeline. Handlebars.precompile() is the API through which developers convert a Handlebars template string into JavaScript source code. Internally, the compiler's code generator uses the quotedString() function (located in lib/handlebars/compiler/code-gen.js) to serialize static template text into the emitted JavaScript as string literals. The core defect is a missing output-escaping step: quotedString() does not neutralize character sequences that would terminate an enclosing HTML <script> element when the generated source is embedded inline in a web page.

In a correctly designed precompiler, any static text — which may originate from untrusted/attacker-controllable input — that gets written into generated JavaScript destined for an inline <script> tag must be escaped such that the byte sequence <, /, and script (and the corresponding closing delimiter) cannot prematurely close the script element in the browser's HTML parser. Because the compiler emits the static text verbatim (only applying JavaScript string-literal quoting, not HTML script-element safe encoding), a crafted template can embed a closing script delimiter. When a browser parses a document containing the generated code inside an inline script, the delimiter terminates the script element. Everything appended after it is then interpreted as HTML markup by the parser, so attacker-controlled markup — for example an onerror-bearing element or an inline event handler — is parsed and executed in the context of the hosting origin.

This is classified as CWE-116 (Improper Encoding or Escaping of Output). The attack surface is the boundary between the JavaScript generation layer and the HTML document layer. The vulnerability is only reachable when three conditions hold simultaneously: (1) an application passes attacker-controllable text through Handlebars.precompile(), (2) the resulting JavaScript is embedded inline in an HTML response rather than served as an external .js file, and (3) the embedding is done without additional application-level escaping. The CVSS vector reflects these stringent preconditions: network attack vector (AV:N), high attack complexity (AC:H) due to the required contextual deployment, no privileges required (PR:N), user interaction required (UI:R) because a victim must load the page, scope changed (S:C) because the injected script executes in the browser origin context, and low confidentiality and integrity impacts (C:L/I:L) with no availability impact (A:N). The CVSS base score is 4.7 — medium severity.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-106444, and the CISA KEV catalog does not list it. The attack chain below is inferred from the vulnerability class and the NVD description; any implementation specifics beyond those stated in the description are not asserted.

1) Reconnaissance / Target Identification. An attacker identifies an application that accepts template content from a user or external source and feeds that content into Handlebars.precompile(), then embeds the generated JavaScript directly into an inline <script> block within a returned HTML document. Applications that display user-supplied templates, template editors, CMS plugin systems, or server-side endpoints that reflect or generate inline precompiled scripts are candidate targets. Reconnaissance focuses on whether template text is user-influenced, whether precompiled output is served inline versus as an external file, and whether any output encoding is applied around the embedding.

2) Triggering the Vulnerability Class. The attacker supplies template text that includes a delimiter capable of terminating an HTML script element. Because quotedString() emits the static template text into generated JavaScript without escaping script-element-terminating sequences, the precompiler produces output that, when placed inside an inline <script>, contains that unescaped terminator. The flaw is a classic unsafe-inline-context encoding weakness (CWE-116): the compiler is unaware of the HTML embedding context of its output.

3) Payload / Execution Method. When the victim loads the page, the browser's HTML parser encounters the unescaped terminator in the generated inline script and closes the script element early. Markup that follows in the generated response — attacker-controlled markup that was injected via the malicious template content — is then parsed as HTML rather than treated as inert script text, resulting in execution of attacker-supplied script or event-handler code in the hosting origin.

4) Post-Exploitation Impact. Successful execution yields script running in the victim origin's context. Based on the CVSS subscores (scope changed, low confidentiality and integrity impact), realistic consequences include session token or cookie theft, in-session action forgery, credential or data harvesting presented to the user, and client-side defacement or redirection. Availability is not directly impacted.

Crucially, the attack only succeeds against the specific deployment pattern described. Applications that serve precompiled templates as an external JavaScript file rather than inline cannot be triggered by this mechanism, and ordinary server-side rendering use of Handlebars is not affected.

Impact Assessment

The business impact is bounded but meaningful for affected deployments. Because exploitation yields script execution with changed scope (S:C), any security controls relying on origin isolation — same-origin cookies, CSRF tokens embedded in the DOM, authenticated session tokens — are exposed to the attacker within the vulnerable page context. The confidentiality and integrity impacts are rated Low (C:L/I:L), consistent with typical reflected/stored XSS-class outcomes rather than full system compromise; availability impact is None (A:N). The high attack complexity (AC:H) and required user interaction (UI:R) reduce the likelihood of exploitation and pull the base score to 4.7 (Medium).

Blast radius is determined by how widely the "inline precompiled, attacker-controllable template" pattern is deployed. Organizations that only use Handlebars.precompile() to produce external bundle files, or that use Handlebars only for server-side rendering, are not exposed to this vulnerability. The patch is version-specific: all releases from 4.0.0 through 4.7.9 are potentially affected, while 4.7.10 and later contain the fix. Because Handlebars is a widely depended-upon npm package that is frequently pulled in transitively, organizations should verify their dependency trees rather than assuming direct usage is the only exposure path. CISA KEV status is NO, EPSS is not yet scored, and no public exploit exists, so real-world exploitation activity is currently expected to be low.

Detection Guidance

Sigma Rule

title: Suspicious Handlebars Precompile Output in Inline Script Context
id: 8c9f2b41-7d3e-4a12-9f55-3c1e6b0a2d77
status: experimental
description: Detects web responses containing Handlebars precompiled JavaScript embedded in an inline script block with script-terminating sequences, indicative of CVE-2026-106444 abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106444
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_script:
    - cs-uri-query|contains:
        - 'precompile'
    - cs-body|contains:
        - 'precompile'
  selection_terminator:
    - cs-body|contains:
        - '</script'
        - '</SCRIPT'
        - '</ScRiPt'
  selection_handlebars:
    cs-body|contains: 'handlebars'
  condition: selection_handlebars and selection_terminator
falsepositives:
  - Legitimate templates that intentionally contain script tags
  - Web application firewall test traffic
level: medium
tags:
  - attack.t1190
  - cwe.116

YARA Rule

rule CVE_2026_106444_Handlebars_Precompile_Injection
{
    meta:
        description = "Detects Handlebars precompiled JavaScript output containing unescaped HTML script-element terminators (CVE-2026-106444)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106444"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $hb1 = "Handlebars.precompile"
        $hb2 = "handlebars.runtime"
        $hb3 = "templateSpec"
        $terminator1 = "</script"
        $terminator2 = "</SCRIPT"
        $terminator3 = "</ScRiPt"
        $xss1 = "onerror=" ascii nocase
        $xss2 = "onload=" ascii nocase

    condition:
        any of ($hb*) and any of ($terminator*) and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106444 Handlebars Precompile Inline Script Termination Attempt"; flow:established,to_client; http.header; content:"text/html"; http.response_body; content:"handlebars"; http.response_body; content:"</script"; nocase; http.response_body; content:"precompile"; nocase; reference:cve,2026-106444; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106444; classtype:web-application-attack; sid:2026106444; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ process where event.type == "start" and process.name in ("node", "nodejs") and process.args : "*precompile*" ]
  [ file where event.action == "creation" and file.extension == "js" and file.path : "*handlebars*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache:access
| eval body=coalesce(response_body, cs_body)
| search body="*handlebars*" body="*precompile*"
| where match(body, "(?i)</scri")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, host
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-106444,">
  <rule id="106444" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">precompile</field>
    <description>CVE-2026-106444: Potential Handlebars precompile inline script-termination injection detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106444,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source was available at the time of this report). The vendor has stated the issue is fixed in version 4.7.10, but no tracked patch source was available to independently confirm.

1) Immediate Mitigations.

• Stop embedding the output of Handlebars.precompile() directly into inline <script> blocks in HTML responses. Serve precompiled templates exclusively as external JavaScript files; per the description, external-serving deployments are not affected.
• If inline embedding cannot be avoided in the short term, apply application-level output encoding that neutralizes script-element-terminating sequences in static template text before the generated source is placed inline.
• Restrict or eliminate the ability for untrusted/attacker-controlled input to reach Handlebars.precompile(). Treat template text as trusted configuration wherever feasible.
• Deploy a web application firewall rule (see Suricata/Sigma guidance above) to flag responses containing inline precompiled Handlebars output with script-terminating sequences.

2) Patch / Upgrade Steps.

• Upgrade Handlebars to version 4.7.10 or later.
• Audit dependency trees (for example via npm ls handlebars and lock file review) to locate both direct and transitive copies of Handlebars in the 4.0.0–4.7.9 range, since the package is frequently pulled in indirectly and multiple versions may coexist.
• After upgrading, re-validate that any application still using inline precompiled output contains no residual unescaped terminators.

3) Long-Term Hardening.

• Adopt a Content-Security-Policy that disallows unsafe inline script execution; a strict CSP mitigates the impact of output-encoding weaknesses of this class by preventing inline event handlers and injected script from executing.
• Enforce a policy of never treating attacker-controllable data as template source, and codify this in code review and linting.
• Standardize output encoding based on the target output context (HTML, inline script, attribute), so that context-appropriate escaping is applied consistently across the codebase.
• Continuously track the upstream Handlebars project for confirmatory advisories, and monitor CVE/NVD feeds for updated EPSS and exploit-status changes.

References

1. NVD — CVE-2026-106444: https://nvd.nist.gov/vuln/detail/CVE-2026-106444
2. MITRE CWE-116 — Improper Encoding or Escaping of Output: https://cwe.mitre.org/data/definitions/116.html
3. Handlebars.js project (upstream source and release information): https://github.com/handlebars-lang/handlebars.js
4. FIRST EPSS (CVE-2026-106444 not yet scored): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106444 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-106444 at the time of writing. CISA KEV status is NO, no public PoC or exploit code is available, no Nuclei template exists, and EPSS has not yet issued a score.