Description
The prototype method blocklist in lib/handlebars/internal/proto-access.js blocks constructor, __defineGetter__, __defineSetter__, and __lookupGetter__, but omits the symmetric __lookupSetter__.
Recommendation
Update the handlebars package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.6.0, <= 4.7.8
- Patched version(s): 4.7.9
References
Could your website be exposed too?
SmartScanner can check your website for Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Handlebars.js has a Property Access Validation Bypass in container.lookup - Vulnerability
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - Vulnerability
- mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: - Vulnerability
- Prototype Pollution in handlebars - handlebars - GHSA-q42p-pg8m-cqh6 - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated March 29, 2026