{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-106446",
    "url": "https://cveboard.org/i/cve-2026-106446",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-106446",
    "json": "https://cveboard.org/i/cve-2026-106446.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)",
    "summary": "Handlebars.compile() and Handlebars.precompile() accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked.",
    "titlePt": "Handlebars: Injeção de JavaScript via confusão de tipo AST em compile (contorno de CVE-2026-33937)",
    "summaryPt": "Handlebars.compile() e Handlebars.precompile() aceitam uma AST pré-analisada, bem como uma string de modelo. Handlebars 4.7.9 adicionou validação para tais ASTs. Ele verifica apenas os valores em nós PathExpression, NumberLiteral e BooleanLiteral, e o compilador ainda escreve vários outros valores AST no JavaScript gerado sem verificação.",
    "cves": [
      "CVE-2026-106446"
    ],
    "ghsa": "GHSA-8r5x-fm3f-whwj",
    "cvss": {
      "score": 9.8,
      "version": "3.1"
    },
    "epss": {
      "percentage": 0.0064,
      "percentile": 0.4956,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "handlebars",
        "vulnerable": ">= 4.0.0, <= 4.7.9",
        "fixed": "4.7.10",
        "advisory": "GHSA-8r5x-fm3f-whwj"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-8r5x-fm3f-whwj"
      }
    ],
    "publishedAt": "2026-10-08T17:52:32.000Z",
    "updatedAt": "2026-10-08T17:52:32.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-8r5x-fm3f-whwj:ghsa_published:2026-10-08T17:52:32.000Z",
      "incidentId": "cve-2026-106446",
      "type": "ghsa_published",
      "at": "2026-10-08T17:52:32.000Z",
      "detail": {
        "ghsa": "GHSA-8r5x-fm3f-whwj",
        "severity": "critical",
        "fixed": "4.7.10"
      }
    }
  ]
}