CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass
Attackers can execute arbitrary JavaScript by bypassing prototype checks in Handlebars templates when specific configuration options are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106445?
CVE-2026-106445 is a critical code injection vulnerability in handlebars-lang handlebars.js, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
Which versions are affected by CVE-2026-106445?
2 open source packages ship an affected version, including handlebars.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | From 3.0.0 | 4.7.10 |
handlebars npm | From 3.0.0 | 4.7.10 |
How do I fix CVE-2026-106445?
Upgrade handlebars to 4.7.10 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-106445 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106445 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLEANSTART-2026-HT67840, CLSA-2026-1791679650, CLSA-2026-1791827421, DEBIAN-CVE-2026-106445, ECHO-99e3-a778-74df, GHSA-p8wg-vrv2-v86f and 13 more.