CVE-2026-71286: miguelcobain ember-dynamic-render-template, инжекция

Описание

Оригинално описание

The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.

Засегнати продукти

• miguelcobain ember-dynamic-render-template: до 0.0.6

Вид слабост

• CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-71286
• https://nvd.nist.gov/vuln/detail/CVE-2026-71286
• https://github.com/miguelcobain/ember-dynamic-render-template
• https://github.com/miguelcobain/ember-dynamic-render-template/blob/master/addon/components/render-template.js