The render‑template component in the ember‑dynamic‑render‑template addon passes its any supplied templateString directly to Ember/Glimmer’s compileTemplate function without sanitization or validation. This behavior permits client‑side template injection, allowing an attacker to embed arbitrary Handlebars expressions that will be compiled and executed in the context of the rendering component. If the application exposes useful helpers or context to the compiled template, the attacker may achieve cross‑site scripting by running malicious JavaScript in the victim’s browser, potentially exposing session data or other sensitive information to the attacker.

All installations of the ember‑dynamic‑render‑template addon are potentially affected, particularly those that render data controlled by users through the templateString property. No specific version range is listed, so every released version should be treated as vulnerable until a fix is available.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is unknown and the vulnerability is not present in the CISA KEV catalog, suggesting that no public exploits have been reported yet. The attack vector is client‑side; an attacker supplies malicious content to the templateString input, which is then compiled and executed by the application, leading to a XSS attack if the environment permits.