{"id":"CVE-2026-71286","summary":"ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString","details":"The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.","modified":"2026-08-28T11:30:48.252739565Z","published":"2026-08-05T12:26:31.793Z","database_specific":{"cwe_ids":["CWE-1336"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71286.json","cna_assigner":"TuranSec"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71286.json"},{"type":"ADVISORY","url":"https://github.com/miguelcobain/ember-dynamic-render-template"},{"type":"ADVISORY","url":"https://github.com/miguelcobain/ember-dynamic-render-template/blob/master/addon/components/render-template.js"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71286"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/miguelcobain/ember-dynamic-render-template","events":[{"introduced":"0"},{"last_affected":"7b2e64335147529f787c8cbeb31e06d0e315fd18"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.0.6"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71286.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}