Handlebars 4.7.9 AST Validation Bypassed in Critical Remote Code Execution Flaw

A critical remote code execution vulnerability has been identified in the Handlebars JavaScript templating engine, affecting versions 4.0.0 through 4.7.9. The flaw, tracked as CVE-2026-106446, allows attackers to bypass security validations added in the 4.7.9 release, potentially enabling the execution of arbitrary JavaScript code.

The vulnerability stems from incomplete validation of Abstract Syntax Trees (ASTs) passed to the `Handlebars.compile()` and `Handlebars.precompile()` functions. While version 4.7.9 introduced checks for specific node types—namely `PathExpression`, `NumberLiteral`, and `BooleanLiteral`—the compiler continues to write other AST values into the generated JavaScript without verification.

If an application passes an untrusted object, such as a parsed JSON request body, to these functions, that object can carry malicious JavaScript payloads. When using `compile()`, this code executes on the server during template rendering. With `precompile()`, the malicious code is embedded in the output and runs wherever that output is loaded.

Technical Details of the Bypass

The validation logic in version 4.7.9 operates within the `parseWithoutProcessing()` function, which traverses the entire AST. However, it only inspects values on nodes with specific types. It ignores plain objects lacking a `type` field, as well as strings and other non-object values. The compiler subsequently reads these unchecked values and inserts them directly into the generated code.

According to the GitHub advisory, several specific AST values are written into the generated code as-is:

• `Program.blockParams.length` is written as `container.program(<index>, data, <length>)` under default options.
• The `depth` property on parameters that are not `PathExpression` nodes, such as `StringLiteral`, is written as `depths[<depth>]` when the `stringParams` option is true.
• A `StringLiteral.value` that is not a string is written as a raw JavaScript literal when `stringParams` is true.
• A `PathExpression.original` that is not a string is written as a raw JavaScript literal when `stringParams` is true.

The first scenario works with default options. A `Program` object containing `blockParams` with a `length` property set to a JavaScript expression passes validation because the `blockParams` object lacks a `type` field, causing the type-specific checks to be skipped. This flaw bypasses the AST validation added in 4.7.9 to address previous issues, including GHSA-2w6w-674q-4c4q, GHSA-xhpv-hc6g-r9c6, and GHSA-3mfm-83xf-c92r.

Who Is Affected

Applications that exclusively pass template strings to Handlebars are not affected by this vulnerability. The risk exists only when applications pass pre-parsed AST objects or untrusted data structures that resemble ASTs to the compilation functions. Developers who accept user input and parse it into an object before passing it to `compile()` or `precompile()` are potentially exposed.

What should you do?

Users of the Handlebars npm package should update to version 4.7.10 immediately, as this version contains the fix for CVE-2026-106446. Organizations should audit their codebases to identify any instances where untrusted objects are passed to `Handlebars.compile()` or `Handlebars.precompile()`. If immediate updates are not possible, ensure that only trusted template strings are used in these functions.