Disclosure summary
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
Source-reported weakness categories
CWE-184, CWE-1289
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-106445
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
GitHub Reviewed Security Advisories · GHSA-p8wg-vrv2-v86f
Open original source · Updated Oct 08, 2026
Handlebars: JavaScript Injection via Own Property Check Bypass
Source severity: CRITICAL / 9.2
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | handlebars | >= 4.0.0, | 4.7.10 |
Original records & references
PUBLISHED 2026-10-06T16:17:26-04:00
MODIFIED 2026-10-08T22:16:59-04:00
INGESTED 2026-10-10T20:50:46-04:00