CVE-2026-71286 — ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString
The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @emb…
Published: 2026-08-05 · CVSS: 6.1 · CVSS 3.1
The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7