{"id":"CVE-2026-71286","summary":"ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString","details":"The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its `templateString` property directly into Ember/Glimmer's compileTemplate() (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input. Because compileTemplate() dynamically compiles and renders the supplied string as a live Handlebars/Glimmer template, any application that renders attacker-influenced data through this component's templateString property is exposed to client-side template injection: an attacker-controlled Handlebars expression is compiled and executed in the context of the rendering component, which can be leveraged for cross-site scripting depending on what helpers/context are exposed to the compiled template.","modified":"2026-08-07T03:46:54.178731234Z","published":"2026-08-05T12:26:31.793Z","database_specific":{"cwe_ids":["CWE-1336"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71286.json","cna_assigner":"TuranSec"},"references":[{"type":"WEB","url":"https://github.com/miguelcobain/ember-dynamic-render-template/blob/master/addon/components/render-template.js"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71286.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71286"},{"type":"PACKAGE","url":"https://github.com/miguelcobain/ember-dynamic-render-template"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/miguelcobain/ember-dynamic-render-template","events":[{"introduced":"0"},{"last_affected":"7b2e64335147529f787c8cbeb31e06d0e315fd18"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.0.6"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71286.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}