ETK-2026-764Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-764",
  "cve_id": null,
  "display_id": "ETK-2026-764",
  "ghsa_id": null,
  "euvd_id": null,
  "status": "retired",
  "anchor_state": "awaiting_cve",
  "title": "Code injection through untrusted AST input in Handlebars",
  "summary": "The npm handlebars package is affected when application-controlled objects can be supplied to compile() or precompile() instead of template text. An attacker may cause supplied JavaScript to run in the server process during rendering or in an environment that loads generated templates.",
  "mitigation": "Require compile() and precompile() inputs to be strings, rejecting objects including request-body values. Use handlebars/runtime on servers when templates can be compiled during the build process.",
  "vendor": "npm",
  "product": "npm:handlebars",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, <= 4.7.9"
      ],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "handlebars",
      "purl": "pkg:npm/handlebars"
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": null,
  "signals": {}
}