CVE-2026-106445

Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: true can inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.

No known exploitation

Severity

Critical, CVSS 9.2 (v4.0)

EPSS

0.41% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)

Affected packages

• handlebars (npm) >= 3.0.0, <= 4.7.9, fixed in 4.7.10 · GHSA-p8wg-vrv2-v86f