Type Confusion in handlebars.js - CVE-2026-106446
Published: October 7, 2026
Vulnerability identifier: #VU153891
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-106446
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to type confusion in the AST validation and code generation used by Handlebars.compile() and Handlebars.precompile() when processing untrusted pre-parsed AST objects. A remote attacker can submit a specially crafted AST object containing values that are written unchecked into generated JavaScript to execute arbitrary JavaScript code.
Applications that only pass template strings are not affected. The Program.blockParams.length vector works with default compile options and does not require the referenced block helper to exist.
Affected software
handlebars.js
Fedora
python-robotframework
Fedora
python-robotframework
How to mitigate CVE-2026-106446
Install security update from vendor's website.
handlebars.js - update to 4.7.10
python-robotframework - update to 7.5.1-1.fc46
python-robotframework - update to 7.5.1-1.fc46