Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-106445: Handlebars templates can run attacker code on server
CVE-2026-106445 · published 12 days ago
Summary
Versions of Handlebars from 3.0.0 through 4.7.9 let a specially crafted template execute any JavaScript on the server when a certain setting is turned on. This can let an attacker take control of the application’s privileges. Upgrade Handlebars to version 4.7.10 or later to stop this behavior.
What to do
- Update handlebars to version 4.7.10.
- Update debian node-handlebars to version 3:4.7.10-1.
- Update handlebars to version 4.7.9-aikido.2.
- Update rootio @rootio/handlebars to version 4.7.9-root.io.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | handlebars-lang | handlebars.js |
>= 4.0.0, < 4.7.10 >= 3.0.0, < 4.7.10 |
| Debian:12 | debian | node-handlebars | All versions |
| Ubuntu:18.04:LTS | canonical | node-handlebars | All versions |
| npm | – | handlebars |
>= 4.0.0, <= 4.7.9 >= 4.0.0, < 4.7.10 >= 3.0.0, <= 4.7.9 >= 3.0.0, < 4.7.10 Fix: upgrade to 4.7.10
|
| Debian:14 | debian | node-handlebars |
< 3:4.7.10-1 Fix: upgrade to 3:4.7.10-1
|
| Root:npm | – | handlebars |
< 4.7.9-aikido.2 Fix: upgrade to 4.7.9-aikido.2
|
| Root:npm | rootio | @rootio/handlebars |
< 4.7.9-root.io.2 Fix: upgrade to 4.7.9-root.io.2
|
Original advisory text
CVE-2026-106445 in handlebars - Patched by Root
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, the template can traverse from that function through its prototype to Function.prototype and then obtain the Function constructor through the own-property bypass. This permits attacker-controlled JavaScript to execute with the server application's privileges. This issue is fixed in version 4.7.10.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-1064... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-106445 Vendor Advisory
- https://github.com/advisories/GHSA-p8wg-vrv2-v86f
- https://github.com/handlebars-lang/handlebars.js Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-106445 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-106445 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-106445 Third Party Advisory
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-v... Third Party Advisory
- https://github.com/handlebars-lang/handlebars.js/pull/2185 Third Party Advisory
- https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f636986... Patch
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10 URL
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-184Incomplete List of Disallowed Inputs
CWE-1289Improper Validation of Unsafe Equivalence in Input
Timeline
Published6 Oct 2026
Updated17 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-106445 · NVD
CVE-2026-106445 · MITRE
DEBIAN-CVE-2026-106445 · OSV
CVE-2026-106445 · OSV
GHSA-p8wg-vrv2-v86f · GHSA
UBUNTU-CVE-2026-106445 · OSV
GHSA-p8wg-vrv2-v86f · OSV
Track software like this
Free during beta