CVE-2026-106445: Handlebars JavaScript Injection Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-106445: Handlebars: JavaScript Injection via Own Property Check Bypass. Affects handlebars versions >= 4.0.0, < 4.7.10. Fixed in 4.7.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Handlebars is a popular templating engine for JavaScript that allows developers to create dynamic HTML content. It is widely used in web applications to separate HTML generation from the application logic. The library provides features such as helpers, partials, and the ability to create reusable templates. However, a critical vulnerability has been identified that can lead to remote code execution if certain configurations are used.
Vulnerability Detail
The vulnerability arises from Handlebars' handling of the Function constructor when templates reach Function.prototype. The lookupProperty function trusts own properties, allowing an attacker to bypass the deny list that is meant to block access to dangerous methods like constructor. This can lead to the execution of arbitrary JavaScript code on the server, resulting in remote code execution. The vulnerability is particularly dangerous when allowProtoMethodsByDefault is set to true, as it allows attackers to exploit the prototype chain to access the Function constructor and execute malicious code.
How To Fix
Latest published version: 4.7.10 as of 22 Oct 2026
npm install handlebars@4.7.10The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update Handlebars immediately, avoid setting allowProtoMethodsByDefault: true when compiling templates with untrusted data. This will help mitigate the risk of exploitation until you can apply the patch.
Conclusion
The Handlebars vulnerability CVE-2026-106445 poses a significant risk to applications using this templating engine, especially when certain configurations are enabled. It is crucial to update to the patched version or implement workarounds to mitigate the risk of exploitation.
See every vulnerability recorded for handlebars →
FAQ
CVE-2026-106445 is a critical vulnerability in the Handlebars templating engine that allows for JavaScript injection and remote code execution.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score of this vulnerability is 9.2, indicating a critical level of severity.
As a temporary measure, do not set allowProtoMethodsByDefault: true when compiling templates with untrusted data to reduce the risk of exploitation.
If exploited, this vulnerability can allow an attacker to execute arbitrary JavaScript code on the server, potentially leading to data breaches or complete server compromise.
References
Related vulnerabilities
Recent vulnerabilities recorded for handlebars.
