Template Injection Vulnerability in ember-dynamic-render-template by Ember

CVE-2026-71286

What is CVE-2026-71286?

The render-template component of ember-dynamic-render-template allows unsanitized user input to be passed directly to the compileTemplate() function from Ember's template compilation. This results in a vulnerability where attacker-controlled Handlebars expressions can be dynamically compiled and executed. If applications render data influenced by an attacker through the templateString property, they risk exposing themselves to client-side template injection attacks. This can lead to severe security issues, such as cross-site scripting, depending on the context and helpers available within the compiled template.

References