Handlebars.js has a Property Access Validation Bypass in container.lookup

Description

In lib/handlebars/runtime.js, the container.lookup() function uses container.lookupProperty() as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (depths[i][name]).

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, <= 4.7.8
• Patched version(s): 4.7.9

References

• GHSA-442j-39wm-28r2
• CWE-367