CyberRota Analysis
AI-GeneratedThe render-template component in ember-dynamic-render-template is vulnerable due to the direct passing of the `templateString` property into the compileTemplate() function without proper input sanitization or validation. This flaw allows for client-side template injection, enabling attackers to execute arbitrary Handlebars expressions, potentially leading to cross-site scripting (XSS) attacks. Developers and organizations using this component should prioritize addressing this vulnerability to safeguard against potential exploitation in their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.