Handlebars.js: JavaScript injection via prototype constructor bypass
Summary
Handlebars.js, a JavaScript templating library, lets a template read the Function constructor through an own-property check bypass on 'constructor'. If an application renders attacker-controlled templates with allowProtoMethodsByDefault enabled and an accessible function in the template context, an attacker can run arbitrary JavaScript with the privileges of the server application. A public proof of concept exists.
Affected
- handlebars (npm) from 3.0.0 up to but excluding 4.7.10 according to the CVE record
- Some third-party databases list 4.0.0 as the starting version; verify against the NVD entry
Fixed in
- Upgrade to handlebars 4.7.10 or later
Workaround
- Keep allowProtoMethodsByDefault disabled (default setting)
- Do not allow untrusted users to supply templates that are compiled on the server
- The vendor advisory lists no other workarounds
Exploitation
- Public proof of concept: yes (third-party repository)
- CISA SSVC: exploitation 'poc', automatable yes, technical impact total
- No in-the-wild exploitation report found; CISA KEV status not verified
Our recommendation
- Inventory Node.js applications and lockfiles for handlebars versions 3.0.0 to 4.7.9, including transitive dependencies
- Upgrade to 4.7.10 or later and test for regressions
- Verify that allowProtoMethodsByDefault is off and that no untrusted input reaches compile()
- Ask vendors of applications with customer-editable templates when they will ship the fix
- Also apply the fix for the related CVE-2026-106446, which is fixed in the same release
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
murrez/CVE-2026-106445
Research sources
- GitHub Security Advisory GHSA-p8wg-vrv2-v86f github.com
- Release v4.7.10 github.com
- Fix commit ceec388 github.com
- Pull Request #2185 github.com
- OSV record CVE-2026-106445 osv.dev
- GitLab advisory CVE-2026-106445 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:51.
Original description (NVD)
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
NVD references (5)
- https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa
- https://github.com/handlebars-lang/handlebars.js/pull/2185
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.