CVE-2026-71286CWE-1336

CVE-2026-71286

Medium · published August 5, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2026-08-05T17:24Z
References (2)
https://github.com/miguelcobain/ember-dynamic-render-template · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/miguelcobain/ember-dynamic-render-template/blob/master/addon/components/render-template.js · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 05 AUG 12:26Z
    ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString
    cvelistv5