Update Handlebars to 4.7.10 to block CVE-2026-106445 RCE prototype bypass
A critical remote code execution vulnerability in the Handlebars template engine is resolved in version 4.7.10, which stops attackers from bypassing security filters.
Key points
- CVE-2026-106445 allows remote code execution by bypassing the prototype-access deny list.
- The flaw affects Handlebars versions 4.0.0 through 4.7.9; version 4.7.10 patches the issue.
- Attackers can exploit the bug if they control templates and the allowProtoMethodsByDefault setting is true.
The maintainers of the Handlebars template engine have released version 4.7.10 to address a critical security vulnerability that allows attackers to execute arbitrary code on servers. This update resolves CVE-2026-106445, a flaw that enabled malicious users to bypass built-in security restrictions designed to prevent prototype pollution attacks.
In plain English
Handlebars is a popular tool used by developers to create dynamic web pages by inserting data into templates. To keep servers safe, the software includes a "deny list" that blocks access to dangerous programming functions, such as the ability to run new code.
The vulnerability existed because the software checked this deny list only for certain types of data. It failed to check the list when accessing properties that belonged directly to the prototype objects themselves. Because the `constructor` property is an inherent part of these prototype objects, the software returned it without verifying if it was safe. This allowed attackers to access the `Function` constructor, which can run any JavaScript code the attacker chooses.
The background
According to the GitHub advisory GHSA-p8wg-vrv2-v86f, the issue stems from how the `lookupProperty` function handles property access. The function uses a check to see if a property belongs directly to an object. If it does, the function returns the value immediately.
Normally, values derived from prototypes are sent to a safety check called `resultIsAllowed`, which blocks dangerous names like `constructor`. However, because `constructor` is an own property of prototype objects like `Function.prototype`, it bypassed this safety check. An attacker could exploit this by reaching a prototype object and then accessing its `constructor` property. This required the template context to have an accessible function and the `allowProtoMethodsByDefault` setting to be true.
What changes now
Organizations using Handlebars versions 4.0.0 through 4.7.9 are vulnerable to this attack. The release of version 4.7.10 fixes the logic error in the property lookup process. Security teams should verify their installations and apply the update to ensure the deny list is correctly enforced for all property accesses.
What to do and how to stay safe: Handlebars
- Audit your project dependencies to identify any installations of Handlebars version 4.0.0 through 4.7.9.
- Update your Handlebars package to version 4.7.10 or later to apply the security fix.
- Review your application configurations to ensure `allowProtoMethodsByDefault` is disabled unless strictly necessary.
- Monitor server logs for unusual JavaScript execution attempts or unexpected function calls that may indicate exploitation.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Handlebars are affected by this vulnerability?
Versions 4.0.0 through 4.7.9 are vulnerable; version 4.7.10 contains the fix.
What is the severity of CVE-2026-106445?
The vulnerability is rated as critical severity.
Do I need to worry if I do not use templates with user-controlled input?
The exploit requires an attacker to render a controlled template, so if your application does not allow this, the risk is lower, but updating is still recommended.
