Handlebars’ precompile function inserts template text directly into the generated JavaScript without escaping characters that could terminate an enclosing HTML <script> element. When an attacker controls the template content and the application embeds the compiled code inline, a specially crafted string can close the <script> tag and inject arbitrary markup or script that will then be parsed and executed by the victim’s browser. This flaw is a form of client‑side code injection that can lead to cross‑site scripting attacks, potentially exposing sensitive data or executing malicious actions on behalf of the user. The underlying weaknesses include improper handling of quoted strings (CWE‑116) and cross‑site scripting (CWE‑79).

The vulnerability affects handlebars.js releases from 4.0.0 up to and including 4.7.9. The Handlebars.js library is maintained by the handlebars‑lang organization. The fix was introduced in version 4.7.10.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can influence the template text that an application precompiles and embeds inline, a scenario that may arise if user input is used as template content. Once applied, the attack occurs in the victim’s browser and can be performed remotely by simply serving malicious template data.