CVE-2026-71286

Name of the Vulnerable Software and Affected Versions ember-dynamic-render-template (affected versions not specified)

Description The render-template component in addon/components/render-template.js passes the templateString property directly into the compileTemplate() function from @ember/template-compilation without sanitization, allow-listing, or validation. Since compileTemplate() dynamically compiles and renders the string as a live Handlebars/Glimmer template, applications rendering attacker-influenced data through this property are susceptible to client-side template injection. This allows an attacker-controlled Handlebars expression to be executed in the context of the rendering component, potentially leading to cross-site scripting (XSS) depending on the available helpers and context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.