Handlebars Sandbox Escape (CVE-2026-106445): constructor Own-Property and Server Preview APIs
Admin · October 18, 2026 · 5 views
User templates are code paths, not “just HTML”
CVE-2026-106445 affects Handlebars.js 4.0.0 – 4.7.9: with allowProtoMethodsByDefault: true, attacker-controlled templates can reach Function.prototype.constructor as an own property, escape the sandbox, and execute JavaScript (CWE-184, CWE-1289, CVSS 4.0 9.2, AT:P).
Fixed in 4.7.10 (GHSA-p8wg-vrv2-v86f).
PoC: CVE-2026-106445 on pocbit.org. Verify marker: POCBIT-106445-OK.
Why npm audit is not enough
| Myth | Reality |
|------|---------|
| “We have Handlebars in package-lock” | Bug fires only when your app compiles untrusted templates with unsafe options |
| “It’s a front-end .min.js include” | Static CDN script ≠ server POST /render preview APIs |
| “Prototype pollution CVEs are all the same” | Here lookupProperty returns own props before deny-list — constructor on Function.prototype wins |
Typical vulnerable pattern: Express (or similar) preview endpoint, compile(template) from request body, context includes a function for helpers, allowProtoMethodsByDefault: true (default in some hbs setups).
Cross-read: cross-site scripting guide (different class, same “user HTML” mindset), supply chain security, RCE vs local privilege escalation.
Defender checklist
| # | Action | Detail |
|---|--------|--------|
| 1 | Lockfile | handlebars ≥ 4.7.10 everywhere (direct + transitive) |
| 2 | Compile options | Set allowProtoMethodsByDefault: false for untrusted input |
| 3 | API inventory | Search for /render, compile, handlebars, template in routes |
| 4 | Do not | Let users upload .hbs files executed server-side without isolation |
| 5 | Lab | PoC Docker lab --mode check then exploit on 4.7.9 only |
python poc.py -u http://127.0.0.1:13045 --mode check
python poc.py -u https://preview.example --render-path /api/preview --mode exploit --insecure
FAQ
WordPress / Joomla site — affected?
Only if a Node (or embedded) service compiles Handlebars server-side with unsafe options — not generic PHP CMS core.
WAF block?
Template payloads are app-specific; upgrade Handlebars is the fix.
Bottom line
CVE-2026-106445 rewards teams that map server-side template preview features, not just dependency versions. Bump to 4.7.10+, disable allowProtoMethodsByDefault for external templates, and treat POST { "template": "..." } like arbitrary code submission.