NPM: Handlebars: JavaScript Injection via Own Property Check Bypass

NPM: Handlebars: JavaScript Injection via Own Property Check Bypass vulnerability discovered by ? in WordPress Npm handlebars versions = 4.0.0, = 4.7.9...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of Function.prototype. When an attacker ca...

CVE-2026-106445

The Handlebars template engine is vulnerable to JavaScript Injection in versions 4.0.0 through 4.7.10 . The root cause is an own property check bypass in the lookupProperty function, which returns Function.prototype.constructor before applying the prototype-access deny list. If an attacker can re...