CVE-2026-106445

Executive Summary

CVE-2026-106445 is a prototype-access bypass vulnerability in the Handlebars templating engine, affecting versions 4.0.0 through 4.7.9. The flaw allows an attacker who can render a controlled template, with allowProtoMethodsByDefault enabled, to traverse prototype chains and obtain the Function constructor, leading to attacker-controlled JavaScript execution with the privileges of the server application. Applications that compile and render user-supplied or untrusted Handlebars templates are at critical risk of remote code execution (RCE). The issue is fixed in Handlebars 4.7.10.

Technical Analysis

Handlebars is a semantic templating engine widely used in Node.js and browser environments. The vulnerability resides in the lookupProperty function's enforcement of its prototype-access deny list. Prior to version 4.7.10, lookupProperty returns Function.prototype.constructor before applying the deny list, because constructor is an own property of Function.prototype rather than an inherited one.

The deny list is intended to block access to dangerous properties such as __proto__, constructor, and prototype. However, the ordering flaw means that when a template context contains an accessible function, the template can traverse from that function through its prototype to Function.prototype and retrieve the Function constructor directly. This constitutes a CWE-184 (Incomplete List of Disallowed Inputs) weakness: the deny list is incomplete because it does not account for the own-property semantics of constructor on Function.prototype.

The attack surface is any application that renders Handlebars templates derived from untrusted input. When allowProtoMethodsByDefault is enabled (or equivalent prototype-access settings permit prototype traversal), an attacker can use Handlebars syntax to navigate the prototype chain. The precondition is an accessible function present in the template context—common in applications that pass configuration objects, helper functions, or callback references into the template context.

Because the obtained primitive is the Function constructor, an attacker can construct and execute arbitrary JavaScript. This moves the vulnerability from a sandbox escape into full RCE within the Node.js process or browser context, with all the privileges of the host application. This includes access to environment variables, filesystem reads/writes permitted to the process, network egress, and any secrets held in process memory.

The root cause is the semantic mismatch between how the deny list was designed (assuming constructor is reached via inheritance) and how JavaScript prototypes actually expose constructor as an own property on Function.prototype. This is a subtle but critical ordering and property-ownership bug in the security control, not a design flaw in templating itself.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The following steps describe the exploitation at the vulnerability-class level.

1. Reconnaissance/target identification: The attacker identifies an application that compiles Handlebars templates from user-controlled input, or that passes untrusted data into templates rendered with allowProtoMethodsByDefault enabled. Candidates include content management systems, low-code/no-code platforms, email template builders, reporting engines, and any Node.js service exposing template customization to end users. Public fingerprints such as Handlebars error pages, client-side bundle references, or render endpoints assist identification.

2. Triggering the flaw class: The attacker submits a template payload that navigates from an accessible function in the template context through its prototype chain. The lookupProperty function is invoked during template evaluation, and because constructor is an own property of Function.prototype, the deny-list check is bypassed. This yields a reference to the Function constructor.

3. Payload/execution method at the vulnerability-class level: With the Function constructor obtained, the attacker constructs a new function from a string, achieving arbitrary JavaScript execution. The exact template syntax required depends on the accessible function and context shape, but the mechanism is prototype traversal leading to a constructor invocation.

4. Post-exploitation impact: The executed JavaScript runs with the server application's privileges. Typical post-exploitation actions include reading environment variables and secrets, exfiltrating data over the network, writing files to the host filesystem, loading additional modules, and pivoting to other internal services reachable from the compromised process. In a browser context, the impact is client-side code execution against users of the vulnerable application.

Note that this vulnerability is a server-side RCE primitive when the template context provides an accessible function and prototype methods are permitted. The absence of a public PoC does not reduce the severity given the well-understood nature of prototype-chain escapes.

Impact Assessment

The impact is critical. Successful exploitation results in arbitrary JavaScript execution with the privileges of the vulnerable application. In a Node.js context this is effectively remote code execution on the server host accessible to the process, enabling full compromise of confidentiality, integrity, and availability of the affected service and any data or credentials it can reach.

Using the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the base score is 9.8 (Critical). Network attack vector, low complexity, no privileges required, and no user interaction, with high impact to all three security objectives. No CVSS score was provided in the source data; the vector above reflects the vulnerability class and is provided for analytical context only.

Blast radius: every application that renders untrusted Handlebars templates with prototype methods enabled is affected. This includes multi-tenant SaaS platforms where one tenant's template could compromise the shared process, and internal tooling where template input is treated as less risky and therefore less guarded. Organizations should inventory their dependency graph for Handlebars versions in the 4.0.0–4.7.9 range and treat any template-rendering path that consumes untrusted input as a priority.

Detection Guidance

Sigma Rule

title: Handlebars Function Constructor Prototype Bypass Attempt
id: d4f1a2c3-8b67-4e29-9a7d-6c1f0e2b3a44
status: experimental
description: Detects Handlebars template payloads attempting to traverse prototype chains to reach Function.prototype.constructor, exploiting CVE-2026-106445.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-106445
author: valtersit.com
date: 2026/01/01
tags:
    - attack.t1190
    - cve.2026.106445
logsource:
    category: application
    product: nodejs
detection:
    keywords_payload:
        - 'constructor'
        - 'Function'
        - 'prototype'
    keywords_context:
        - 'handlebars'
        - 'allowProtoMethodsByDefault'
        - 'lookupProperty'
    condition: keywords_payload and keywords_context
fields:
    - http.request.body
    - template
    - message
falsepositives:
    - Legitimate templates that reference constructor or prototype properties
level: high

YARA Rule

rule CVE_2026_106445_Handlebars_Prototype_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects Handlebars template payloads exploiting CVE-2026-106445 prototype-access deny-list bypass"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106445"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $hbs1 = "allowProtoMethodsByDefault" ascii wide
        $hbs2 = "lookupProperty" ascii wide
        $con1 = "constructor" ascii wide
        $con2 = "Function.prototype" ascii wide
        $con3 = "__proto__" ascii wide
        $tmpl = "{{" ascii wide

    condition:
        (uint16(0) == 0x5A4D or true) and
        (
            ($con1 and $con3 and $tmpl) or
            ($con2 and $tmpl) or
            ($hbs2 and $con1)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106445 Handlebars Prototype Chain Bypass Attempt"; flow:established,to_server; content:"constructor"; http_client_body; nocase; content:"prototype"; http_client_body; nocase; content:"Function"; http_client_body; nocase; reference:cve,2026-106445; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-106445; classtype:web-application-attack; sid:10644501; rev:1;)

Elastic Detection

process where process.name == "node" and
  process.command_line : ("*allowProtoMethodsByDefault*" or "*lookupProperty*")

Applied at the application log layer (e.g., ingest of a template.render event):

any where event.category == "process" and process.name == "node" and
  wildcard(process.command_line, "*constructor*Function*") and
  wildcard(process.command_line, "*{{*")

Splunk SPL Query

index=app sourcetype=nodejs OR sourcetype=handlebars
| search (template="*constructor*" OR body="*constructor*" OR message="*constructor*")
         (template="*prototype*" OR body="*prototype*" OR message="*prototype*")
         ("allowProtoMethodsByDefault" OR "lookupProperty" OR "handlebars" OR "{{")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips values(uri) as uris by host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,handlebars,">
  <rule id="106445" level="12">
    <decoded_as>json</decoded_as>
    <field name="template">\.*constructor\.*</field>
    <field name="template">\.*prototype\.*</field>
    <description>CVE-2026-106445: Handlebars prototype-chain bypass attempt (constructor/prototype reference in template)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_106445,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Disable allowProtoMethodsByDefault (and the equivalent allowProtoPropertiesByDefault setting) wherever templates may include untrusted input.
• Never compile or render templates from untrusted sources. If user-supplied templates are a business requirement, isolate rendering in a restricted context (separate process, minimal privileges, no access to secrets or the filesystem).
• Avoid placing accessible function references (callbacks, helper functions, class instances) in the template context passed to Handlebars when rendering untrusted templates.
• Apply input validation and a template allowlist to reject payloads containing prototype-traversal tokens.
• Consider a Web Application Firewall rule (or an application-level filter) blocking constructor, __proto__, and prototype identifiers in template fields.

2. Patch/upgrade steps

• Upgrade Handlebars to version 4.7.10, which contains the fix for this issue.
• Update the dependency directly and via transitive dependencies; run npm ls handlebars (or the equivalent for your package manager) to confirm no vulnerable copies remain in the tree.
• Rebuild and redeploy affected services, and verify the resolved version in production using a dependency inventory.
• If you cannot upgrade immediately, apply the immediate mitigations above as compensating controls.

3) Long-term hardening

• Pin and monitor all templating engine dependencies with an SCA tool; alert on versions in the 4.0.0–4.7.9 range.
• Adopt a principle of least privilege for Node.js application processes (non-root user, restricted filesystem access, network egress controls) to limit the blast radius of any RCE.
• Treat template rendering as a security boundary: apply sandboxing or container isolation, and separate template execution from components holding sensitive secrets.
• Add static analysis and code review gates that flag use of allowProtoMethodsByDefault and untrusted template sources.
• Maintain an SBOM and subscribe to Handlebars security advisories to catch follow-on issues.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106445
• Handlebars releases (4.7.10): https://github.com/handlebars-lang/handlebars.js/releases
• Handlebars project: https://handlebarsjs.com/
• CWE-184: Incomplete List of Disallowed Inputs — https://cwe.mitre.org/data/definitions/184.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Note: No CISA KEV entry, no Nuclei template, and no public exploit code are currently associated with this CVE. No threat actor campaigns or exploit-in-the-wild evidence have been reported at the time of writing. The exploit chain described above is inferred from the vulnerability class and the NVD description, as no public PoC is available.