CVE-2026-106445

CVE-2026-106445 is a deny list bypass vulnerability in the Handlebars.js templating engine, affecting versions 4.0.0 through 4.7.9. The library maintains a prototype-access deny list designed to block access to specific properties, such as `constructor`. However, the `lookupProperty` function returns `Function.prototype.constructor` before applying this deny list because `constructor` is recognized as an own property of `Function.prototype`. An attacker can exploit this flaw if they can render a controlled template with the `allowProtoMethodsByDefault` option enabled and have an accessible function within the template context. By traversing from that function through its prototype to `Function.prototype`, the attacker can bypass the deny list to obtain the `Function` constructor. This allows the execution of arbitrary JavaScript with the privileges of the server application. The issue has been resolved in Handlebars.js version 4.7.10.