Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element. When an application precompiles attacker-controlled template text and embeds the generated source directly in an inline script element, a closing script delimiter can end the element and cause following attacker-controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10,     Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template     text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element.
    When an application precompiles attacker-controlled template text and embeds the generated source directly     in an inline script element, a closing script delimiter can end the element and cause following attacker-     controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates     served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
    (CVE-2026-106444)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10,
    Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template
    text into generated JavaScript without escaping sequences that terminate an enclosing HTML script element.
    When an application precompiles attacker-controlled template text and embeds the generated source directly
    in an inline script element, a closing script delimiter can end the element and cause following attacker-
    controlled markup to be parsed and executed. Ordinary server-side rendering and precompiled templates
    served as external JavaScript files are not affected. This issue is fixed in version 4.7.10.
    (CVE-2026-106444)

ID	Name	Product	Family	Type	Severity
371361	Linux Distros Unpatched Vulnerability : CVE-2026-106444	Nessus	Misc.	Local	medium
474005	Echo: handlebars: security update to 4.7.10	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474005	Echo: handlebars: security update to 4.7.10	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473851	SCA: security update for handlebars (GHSA-xw65-4hp5-5hc7)	Tenable Cloud Security	SCA Checks	Local	medium
473851	SCA: security update for handlebars (GHSA-xw65-4hp5-5hc7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-106444

medium

Tenable Plugins

medium

medium

medium

medium

medium