PT-2026-107181 · Unknown · Handlebars
CVE-2026-106445
·
Published
2026-10-06
·
Updated
2026-10-10
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Handlebars versions 4.0.0 through 4.7.9
Description
Handlebars contains an issue where the
lookupProperty function returns Function.prototype.constructor before applying the prototype-access deny list, as constructor is an own property of Function.prototype. If an attacker can render a controlled template while allowProtoMethodsByDefault is enabled and a function is accessible in the template context, they can traverse from that function to Function.prototype to obtain the Function constructor. This allows the execution of attacker-controlled JavaScript with the privileges of the server application.Recommendations
Update to version 4.7.10.
Exploit
Fix
RCE
Incomplete List of Disallowed Inputs
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Handlebars