CVE-2026-106445Handlebars: JavaScript Injection via Own Property Check Bypass
Updated under an hour ago ()
Does this affect you?
It affects handlebars-lang handlebars.js. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.41%, higher than 34% of scored CVEs.
Do this next
Free account, 1 product
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
- CVSS
- 9.2 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-184, CWE-1289
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.41% (percentile 34)
- Assigned by
- GitHub_M
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
handlebars-lang handlebars.js handlebars_lang:handlebars.js (from the name) | from 3.0.0, < 4.7.10 | CNA record |
References
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86fx-refsource-confirm
- https://github.com/handlebars-lang/handlebars.js/pull/2185x-refsource-misc
- https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fax-refsource-misc
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.