Critical Handlebars RCE Vulnerability Bypasses Prototype Deny List

A critical remote code execution vulnerability in the popular npm Handlebars templating library allows attackers to inject and execute arbitrary JavaScript on servers. The flaw, tracked as CVE-2026-106445, stems from a bypass in the library’s prototype-access deny list that permits access to the Function constructor.

According to the GitHub Security Advisory GHSA-p8wg-vrv2-v86f, the issue affects Handlebars versions 4.0.0 through 4.7.9. The advisory rates the severity as critical. The vulnerability exists because the library’s lookupProperty function trusts own properties of objects without subjecting them to the standard security deny list. This allows an attacker who can control template rendering to reach Function.prototype and access its constructor property, which resolves to the Function object.

Technical Context and Exploitation

The core of the vulnerability lies in how Handlebars handles property lookups on prototype objects. The library includes a deny list designed to block access to dangerous method names such as constructor. Normally, values derived from prototypes pass through a resultIsAllowed check that enforces this deny list. However, the lookupProperty function first checks if a property is an "own property" of the parent object using Object.prototype.hasOwnProperty.

Because constructor is an own property of prototype objects like Function.prototype, String.prototype, and Object.prototype, the library returns the value immediately. This occurs before the deny list is consulted. As a result, the deny list entry for constructor is never evaluated. An attacker can exploit this by accessing a function’s prototype via the proto property, which is permitted when allowProtoMethodsByDefault is true. From there, accessing the constructor property yields the Function constructor, enabling the creation and execution of arbitrary code with attacker-controlled body content.

Affected Versions and Scope

The vulnerability impacts a wide range of Handlebars installations, specifically versions 4.0.0 through 4.7.9. The exploit requires that the application allows prototype method access by default, a configuration often seen in environments where developers need to access prototype methods within templates. The proof of concept described in the advisory demonstrates that an attacker only needs an accessible function in the template context to traverse to Function.prototype. Once there, the bypass allows the retrieval of the Function constructor, leading to remote code execution on the server hosting the application.

What should you do?

Users of the Handlebars npm package should update to version 4.7.10 or later to mitigate this risk. This patched version addresses the prototype-access bypass that allows unauthorized access to the Function constructor. Administrators should audit their applications to ensure they are not running vulnerable versions between 4.0.0 and 4.7.9. While no fix has been confirmed for versions prior to 4.7.10, updating to the patched release is the recommended immediate action.