Handlebars.js validateAstNode Prototype-Chain Bypass RCE (CVE-2026-106446)

QiAnXin CERT rated Handlebars.js CVE-2026-106446 High with a CVSS 3.1 score of 9.8 after public disclosure on 2026-10-06. Unauthenticated remote code execution can follow a validateAstNode prototype-chain bypass in versions 4.0.0 through 4.7.9; the fix is 4.7.10 or later.

Overview

QiAnXin CERT issued a high-risk advisory for Handlebars.js remote code execution tracked as CVE-2026-106446 and QVD-2026-65364. Public disclosure was 2026-10-06. QiAnXin rates the issue High. The CVSS 3.1 score is 9.8. The threat type is code execution. Exploit likelihood is assessed as high. A proof of concept, an exploit, and technical details are public. In-the-wild exploitation has not been found. Estimated exposure is at the 100,000 scale.

Handlebars is an open-source JavaScript semantic template engine for Node.js server rendering and browser rendering. It is referenced by web applications and by report, email, and notification template systems.

Impact

An unauthenticated attacker can bypass upstream safety checks and execute arbitrary commands in the rendering process, which can compromise the server. In container deployments, the container can be fully controlled.

The in-scope condition is a target application that takes an attacker-controlled object, processes it with Object.assign, Object.create, or deep merge, then passes it to Handlebars.compile() or precompile(). Other in-scope patterns include Object.assign({}, userJson), Object.create(userObj), lodash.merge, and defaultsDeep on user input before compile.

Vulnerability

Handlebars.js 4.7.9 introduced validateAstNode to fix CVE-2026-33937, an AST type-confusion issue that led to JavaScript injection. The validator inspects only own enumerable properties using Object.keys. The code generator uses ordinary property access and can read fields along the prototype chain. Validation and compilation therefore disagree on which fields exist, so the check added for CVE-2026-33937 can be skipped while compilation still reads attacker-controlled fields.

QiAnXin CERT states it reproduced CVE-2026-106446.

Affected versions

handlebars.js 4.0.0 through 4.7.9 are affected. Handlebars.js 4.7.8 and earlier remain affected by the direct form of CVE-2026-33937.

Remediation

A vendor fix is available. Affected users should upgrade to Handlebars.js 4.7.10 or later.

Official download: https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10

Temporary measures listed by QiAnXin CERT:

1. Reject non-string input at the entry point. 2. In validateAstNode, reject nodes whose prototype is not Object.prototype or null so validation traversal matches compiler reads. 3. Do not apply Object.assign or deep merge to user JSON. Apply allowlist checks before passing JSON.parse results into compile. 4. Use handlebars/runtime with precompiled templates and remove runtime compile.

References

[1] https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj