CVE-2026-71286

Summary

The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its templateString property directly into Ember/Glimmer's compileTemplate() (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input. Because compileTemplate() dynamically compiles and renders the supplied string as a live Handlebars/Glimmer template, any application that renders attacker-influenced data through this component's templateString property is exposed to client-side template injection: an attacker-controlled Handlebars expression is compiled and executed in the context of the rendering component, which can be leveraged for cross-site scripting depending on what helpers/context are exposed to the compiled template.

Affected Software

Weaknesses

• CWE-1336: CWE-1336

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/miguelcobain/ember-dynamic-render-template
• https://github.com/miguelcobain/ember-dynamic-render-template/blob/master/addon/components/render-template.js

• ←Previous
• Next→