Executive brief
Handlebars.js is a popular template engine used to render dynamic content in web applications. When a non-default security setting (allowProtoMethodsByDefault: true) is enabled, a missing blocklist entry allows attackers to access the __lookupSetter__ prototype method in templates, potentially leading to unauthorized data access or modification.
Technical details
The vulnerability is a prototype method access control gap in lib/handlebars/internal/proto-access.js. The blocklist blocks constructor, __defineGetter__, __defineSetter__, and __lookupGetter__ but omits __lookupSetter__, creating an asymmetric security boundary. When the non-default runtime option allowProtoMethodsByDefault: true is set, any prototype method not in the blocklist is permitted by default. An attacker can reference __lookupSetter__ through untrusted template input to bypass access controls. This only affects applications that explicitly enable allowProtoMethodsByDefault: true; the default configuration is not affected. The vulnerability was fixed in version 4.7.9.
Affected products
- Handlebars Handlebars.js 4.6.0 through 4.7.8
Timeline
- 2026-03-29: disclosed: GHSA-7rx3-28cr-v5wh published
- 2026-03-26: patched: Fixed in version 4.7.9