Technical impact
The render‑template component in the ember‑dynamic‑render‑template addon passes its property directly to Ember/Glimmer’s compileTemplate function without sanitization, allow‑listing, or validation of the input. This allows client‑side template injection, enabling an attacker to embed arbitrary Handlebars expressions that are compiled and executed within the component’s rendering context. If the application context exposes useful helpers or data, the injected template could execute malicious JavaScript in the user’s browser, potentially leaking session data or other sensitive information.
Affected Systems
All installations of the ember‑dynamic‑render‑template addon are potentially affected, particularly those that render data controlled by users through the templateString property. No specific version range is listed, so every released version should be treated as vulnerable until a fix is available.
Risk and Exploitability
The CVSS score of 6.1 indicates a moderate severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that no public exploits have been reported yet. Based on the description, the attack vector is client‑side; an attacker supplies malicious content to the component property, which is compiled and executed by the application, leading to a potential XSS attack if the environment permits.
