CVE-2026-106446

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.9

Description Handlebars.compile() and Handlebars.precompile() functions accept pre-parsed AST (Abstract Syntax Tree) objects but only validate specific PathExpression, NumberLiteral, and BooleanLiteral values. This allows an attacker to bypass AST validation by providing an object instead of a template string. By inserting JavaScript expressions into unchecked values such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value, or a non-string PathExpression.original, the compiler emits these values into the generated JavaScript. This leads to code execution in the server process during the rendering of compile output or the loading of precompile output. Applications that exclusively use template strings are not affected.

Recommendations Update to version 4.7.10.