CVE-2026-106445

A flaw was found in Handlebars. The lookupProperty own-property check returns Function.prototype.constructor before the prototype-method deny list is applied. When an attacker can render a controlled template with allowProtoMethodsByDefault enabled and an accessible function in the template context, arbitrary JavaScript can execute with the application process privileges.

This flaw has an Important impact. Exploitation requires rendering a controlled template with allowProtoMethodsByDefault set to true (off by default) and an accessible function in the template context, allowing bypass of the constructor deny list via Function.prototype. The issue is not Critical for Red Hat scoring because those non-default runtime conditions raise attack complexity (AC:H); default Handlebars configurations that keep allowProtoMethodsByDefault disabled are not exploitable for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data.