Handlebars.js has a Property Access Validation Bypass in container.lookup
- Severity:
- Low
Description
In lib/handlebars/runtime.js, the container.lookup() function uses container.lookupProperty() as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (depths[i][name]).
Recommendation
Update the handlebars package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, <= 4.7.8
- Patched version(s): 4.7.9
References
Related Issues
- Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry - Vulnerability
- validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
You might also like:
- Tags:
- npm
- handlebars
Anything's wrong? Let us know Last updated on March 29, 2026