CVE catalog
CVE-2026-106445
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-a
- Severity
- Critical · CVSS 9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.59% · Oct 25, 2026
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-handlebars | sid | 3:4.7.10-1 | fixed |
| Debian | node-handlebars | forky | 3:4.7.10-1 | fixed |
| Debian | node-handlebars | trixie | 3:4.7.7+~4.1.0-1 | vulnerable |
| Debian | node-handlebars | bookworm | 3:4.7.7+~4.1.0-1 | vulnerable |
| Npm | handlebars | Not reported | 4.7.10 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-handlebars | source | sid | 3:4.7.10-1 | not yet assigned | Not reported | [1150246] |
| Debian | node-handlebars | source | forky | 3:4.7.10-1 | not yet assigned | Not reported | [1150246] |
| Debian | node-handlebars | source | trixie | (unfixed) | not yet assigned | Not reported | [1150246] |
| Debian | node-handlebars | source | bookworm | (unfixed) | not yet assigned | Not reported | [1150246] |
| Npm | handlebars | npm | Not reported | 4.7.10 | Not reported | GHSA-P8WG-VRV2-V86F | Not reported |
Notes
[trixie] node-handlebars: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [handlebars]Affected
Source package: [node-handlebars]
Details (2)
3:4.7.7+~4.1.0-1· all · bookwormAffected
nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
3:4.7.7+~4.1.0-1· all · bookwormAffected
nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
- [libjs-handlebars]Affected
Source package: [node-handlebars]
Details (2)
3:4.7.7+~4.1.0-1· all · bookwormAffected
nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
3:4.7.7+~4.1.0-1· all · bookwormAffected
nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
- [libjs-handlebars.runtime]Affected
Source package: [node-handlebars]
Details (2)
3:4.7.7+~4.1.0-1· all · bookwormAffected
nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
3:4.7.7+~4.1.0-1· all · bookwormAffected
nvd · node-handlebars · debian · bookworm; nvd · node-handlebars · debian · 12
[Debian 13 (Trixie)]
- [handlebars]Affected
Source package: [node-handlebars]
Details (2)
3:4.7.7+~4.1.0-1· all · trixieAffected
nvd · node-handlebars · debian · 13
3:4.7.7+~4.1.0-1· all · trixieAffected
nvd · node-handlebars · debian · 13
- [libjs-handlebars]Affected
Source package: [node-handlebars]
Details (2)
3:4.7.7+~4.1.0-1· all · trixieAffected
nvd · node-handlebars · debian · 13
3:4.7.7+~4.1.0-1· all · trixieAffected
nvd · node-handlebars · debian · 13
- [libjs-handlebars.runtime]Affected
Source package: [node-handlebars]
Details (2)
3:4.7.7+~4.1.0-1· all · trixieAffected
nvd · node-handlebars · debian · 13
3:4.7.7+~4.1.0-1· all · trixieAffected
nvd · node-handlebars · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://github.com/advisories/GHSA-p8wg-vrv2-v86f]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-106445]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-106445]
- [https://security-tracker.debian.org/tracker/CVE-2026-106445]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106445.json]
[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]