CVE-2026-106446

Executive Summary

CVE-2026-106446 is a critical (CVSS 9.8) remote code execution vulnerability in the Handlebars JavaScript templating engine, affecting versions 4.0.0 through 4.7.9. The flaw allows an attacker who can supply a crafted object—rather than a template string—to Handlebars.compile() or Handlebars.precompile() to bypass AST validation and inject JavaScript expressions into generated code, resulting in arbitrary code execution in the server process. Applications that exclusively pass template strings to the compiler are not affected.

Technical Analysis

Handlebars is a popular semantic templating library used extensively in Node.js applications to render dynamic content. The vulnerability resides in the compilation pipeline, specifically in how the library processes pre-parsed Abstract Syntax Tree (AST) objects. Starting with version 4.0.0 and continuing until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept AST objects as input. While these functions validate certain AST node types—specifically selected PathExpression, NumberLiteral, and BooleanLiteral values—they fail to validate all properties that are subsequently emitted into the generated JavaScript code.

This issue represents a bypass of the AST validation that was introduced in version 4.7.9 to address CVE-2026-33937. That prior fix attempted to sanitize AST inputs but left several unchecked properties. An attacker who can supply an object instead of a template string can inject malicious JavaScript expressions into fields such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original. Because the compiler does not validate these values, it directly emits them into the generated JavaScript source code. When that compiled output is rendered—or when precompiled output is loaded—the injected JavaScript executes within the server process.

The attack surface is limited to applications that accept and process user-controlled AST objects. This is not the typical use case for Handlebars, as most applications simply pass template strings. However, certain frameworks, template management systems, or APIs may expose the ability to submit pre-parsed templates or objects that are coerced into AST structures. The vulnerability class is code injection (CWE-94), and the impact is remote code execution with high confidentiality, integrity, and availability impact as reflected in the CVSS vector.

No public proof-of-concept or exploit code is currently available, and the vulnerability has not been observed in the wild. The technical details are derived entirely from the NVD description and the CNA title, which provide sufficient information to understand the mechanism but do not include specific code examples or exploit payloads.

Exploitation Scenarios

The exploitation of CVE-2026-106446 follows a distinct attack chain that hinges on the ability to supply a crafted object to the Handlebars compiler. The following scenarios describe the attack at the vulnerability-class level, as no public PoC is available.

1. Reconnaissance and Target Identification: An attacker identifies a web application or service that utilizes Handlebars versions 4.0.0 through 4.7.9. The attacker looks for endpoints or functionalities that accept template-related input—such as custom template creation, dynamic report generation, or API endpoints that accept pre-parsed templates. The presence of Handlebars can often be inferred from client-side artifacts, error messages, or known framework fingerprints.

2. Triggering the Specific Flaw Class: The attacker crafts a malicious object that mimics an AST node structure. Instead of providing a string template, the attacker supplies an object containing properties that the compiler will process. By manipulating unchecked fields like Program.blockParams.length, parameter depth, StringLiteral.value, or PathExpression.original, the attacker embeds JavaScript code that is not validated. The compiler, expecting these values to be of a certain type (e.g., a number for length, a string for value), instead receives a JavaScript expression or string that will be inserted verbatim into the generated code.

3. Payload Execution Method: When the application invokes Handlebars.compile() or Handlebars.precompile() with the malicious object, the compiler generates JavaScript code that includes the attacker-controlled expression. If the application then renders the compiled template or loads the precompiled output, the injected JavaScript executes in the context of the server process. This is a classic injection into code generation, where the boundary between data and code is violated.

4. Post-Exploitation Impact: Successful exploitation grants the attacker arbitrary code execution with the privileges of the Node.js process. This can lead to full server compromise, data exfiltration, installation of backdoors, lateral movement within the network, and denial of service. Given the CVSS score of 9.8, the impact is severe, affecting confidentiality, integrity, and availability.

No public exploit code exists, and the attack chain is inferred from the vulnerability class. The primary barrier to exploitation is the requirement that the application must accept objects as templates—a non-standard usage pattern. However, applications that expose such functionality (e.g., template editors, low-code platforms) are at high risk.

Impact Assessment

The CVSS v3.1 score of 9.8 (Critical) reflects a network-exploitable, low-complexity vulnerability requiring no privileges or user interaction. The scope is unchanged, meaning the impact is confined to the vulnerable component, but the potential for full system compromise is high. Confidentiality, integrity, and availability impacts are all rated High.

Business impact includes:

• Data Breach: Attackers can access sensitive data processed by the application, including customer information, credentials, and proprietary business logic.
• Service Disruption: Code execution can lead to crash or forced shutdown of the server, affecting availability.
• Reputation Damage: Exploitation can result in public disclosure of a breach, loss of customer trust, and regulatory penalties.
• Lateral Movement: Compromised servers can serve as a pivot point for further attacks within the internal network.

Affected systems are any Node.js applications using Handlebars 4.0.0 to 4.7.9 that accept AST objects from untrusted sources. Given Handlebars' widespread adoption, the blast radius could be significant, though the specific condition of accepting objects limits the number of vulnerable deployments. The EPSS score is not yet available, and there is no evidence of active exploitation or CISA KEV listing.

Detection Guidance

Sigma Rule

title: Handlebars AST Injection Attempt
id: 3f8a2b1c-9d4e-4f7a-8b6c-1e2d3f4a5b6c
status: experimental
description: Detects attempts to exploit CVE-2026-106446 by supplying malicious AST objects to Handlebars compile functions.
author: Threat Intelligence Team
date: 2026-05-12
logsource:
  category: application
  product: nodejs
detection:
  selection:
    EventID: 1
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - 'Handlebars.compile'
      - 'Handlebars.precompile'
      - 'blockParams.length'
      - 'StringLiteral.value'
      - 'PathExpression.original'
  condition: selection
falsepositives:
  - Legitimate development activities
level: high

YARA Rule

rule CVE_2026_106446_Handlebars_AST_Injection
{
    meta:
        description = "Detects malicious AST objects targeting Handlebars compile functions"
        author = "Threat Intelligence Team"
        date = "2026-05-12"
        reference = "CVE-2026-106446"
        hash = "unknown"
    strings:
        $s1 = "Handlebars.compile" ascii wide
        $s2 = "Handlebars.precompile" ascii wide
        $s3 = "blockParams" ascii wide
        $s4 = "StringLiteral" ascii wide
        $s5 = "PathExpression" ascii wide
        $s6 = "original" ascii wide
        $s7 = "NumberLiteral" ascii wide
        $s8 = "BooleanLiteral" ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (2 of ($s1, $s2)) and (3 of ($s3, $s4, $s5, $s6, $s7, $s8))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106446 Handlebars AST Injection Attempt"; flow:to_server,established; content:"Handlebars.compile"; http_client_body; content:"blockParams"; http_client_body; content:"StringLiteral"; http_client_body; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

process where process.name == "node.exe" and process.command_line : ("*Handlebars.compile*" or "*Handlebars.precompile*") and process.command_line : ("*blockParams*" or "*StringLiteral*" or "*PathExpression*")

Splunk SPL Query

index=main sourcetype=nodejs OR sourcetype=application
| search "Handlebars.compile" OR "Handlebars.precompile"
| search "blockParams" OR "StringLiteral" OR "PathExpression" OR "original"
| stats count by host, source, process, _time
| where count > 0

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100100" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url" type="pcre2">.*(Handlebars\.compile|Handlebars\.precompile).*</field>
    <field name="body" type="pcre2">.*(blockParams|StringLiteral|PathExpression).*</field>
    <description>CVE-2026-106446: Handlebars AST injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict the ability to pass objects to Handlebars.compile() or Handlebars.precompile(). Ensure that only template strings are accepted from untrusted sources.
   • Implement strict input validation and type checking on any template-related API endpoints. Reject any input that is not a string.
   • If AST objects must be processed, validate all properties (e.g., blockParams.length, StringLiteral.value, PathExpression.original) to ensure they are of expected primitive types (number, string, boolean) and not executable expressions.
   • Apply the principle of least privilege to the Node.js process to limit the impact of successful exploitation.

2. Patch/Upgrade Steps:

   • Upgrade Handlebars to version 4.7.10 or later. The patch for CVE-2026-106446 is included in 4.7.10, which extends AST validation to cover all emitted properties.
   • Verify the upgrade by checking the package version in package.json and running npm list handlebars.
   • Rebuild and redeploy any applications that bundle Handlebars.

3. Long-Term Hardening:

   • Adopt a security-focused development lifecycle that includes dependency scanning and vulnerability management. Tools like npm audit or Snyk can alert on known CVEs.
   • Avoid exposing template compilation functionality to end-users. If necessary, use sandboxed environments or dedicated template servers with strict isolation.
   • Monitor Handlebars security advisories and GitHub releases for future patches.
   • Conduct regular penetration testing focused on injection flaws, particularly in template engines.

References

• NVD Entry for CVE-2026-106446: https://nvd.nist.gov/vuln/detail/CVE-2026-106446
• Handlebars GitHub Repository: https://github.com/handlebars-lang/handlebars.js
• Handlebars Security Advisories: https://github.com/handlebars-lang/handlebars.js/security/advisories
• CWE-94: Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• CVE-2026-33937 (prior related AST validation bypass): https://nvd.nist.gov/vuln/detail/CVE-2026-33937

No known threat actor campaigns or exploit-in-the-wild evidence are available at this time. CISA KEV does not list this vulnerability.