[From nobody Wed Oct 7 18:21:08 2026 Received: (at submit) by bugs.debian.org; 7 Oct 2026 14:51:12 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.3 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 60; hammy, 150; neutral, 117; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:38218) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xESz9-00443N-36 for submit@bugs.debian.org; Wed, 07 Oct 2026 14:51:11 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=DkPMvfhwHNnW+fZZaCwnNSd4cv97PzjCU+H/hczyioQ=; b=sVOJn7AOYtkio3yur2pM0PVU7e md98ttiY0NE8r29zq44XyjCzZwKs/vw7+PAqOreKPy1DI6Zww0KdU3Or9n2iNz6puA4Em4HXtrcFo 7HbBp6Q4gcv5zWZY47+vPgjPpRp2z2bGw6+A5sTSBQn8XXPQ+m8STocd4OwWkZXWUXCfPejweRCq2 yW9a9EOzKSVsw3GxUyXejfhDwokJUsJ92LanX/YL8L58VfkfXMDAIT/AsLD1JJIXHV9RwFwqTXz0z +cv3IxoEetjP1YPGKLH1cWkbChpifAXp1i85QRQNRtNEUhvZ9MaKtw+PA+9VYiLDD5WeakybONQDa bo+Z4yNg==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xESz8-004p7c-08 for submit@bugs.debian.org; Wed, 07 Oct 2026 14:51:10 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id A8A05DC06C7; Wed, 07 Oct 2026 16:51:09 +0200 (CEST) Date: Wed, 7 Oct 2026 16:51:09 +0200 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: node-handlebars: CVE-2026-106444 CVE-2026-106445 CVE-2026-106446 Message-ID: <asZcXWR2Y_0mGScy@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: node-handlebars Version: 3:4.7.9-6 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Hi, The following vulnerabilities were published for node-handlebars. CVE-2026-106444[0]: | Handlebars provides the power necessary to let users build semantic | templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses | quotedString() in lib/handlebars/compiler/code-gen.js to emit static | template text into generated JavaScript without escaping sequences | that terminate an enclosing HTML script element. When an application | precompiles attacker-controlled template text and embeds the | generated source directly in an inline script element, a closing | script delimiter can end the element and cause following attacker- | controlled markup to be parsed and executed. Ordinary server-side | rendering and precompiled templates served as external JavaScript | files are not affected. This issue is fixed in version 4.7.10. CVE-2026-106445[1]: | Handlebars provides the power necessary to let users build semantic | templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty | returns Function.prototype.constructor before applying the | prototype-access deny list because constructor is an own property of | Function.prototype. When an attacker can render a controlled | template with allowProtoMethodsByDefault enabled and an accessible | function in the template context, the template can traverse from | that function through its prototype to Function.prototype and then | obtain the Function constructor through the own-property bypass. | This permits attacker-controlled JavaScript to execute with the | server application's privileges. This issue is fixed in version | 4.7.10. CVE-2026-106446[2]: | Handlebars provides the power necessary to let users build semantic | templates. From 4.0.0 until 4.7.10, Handlebars.compile() and | Handlebars.precompile() accept pre-parsed AST objects while | validating only selected PathExpression, NumberLiteral, and | BooleanLiteral values. This issue bypasses the AST validation | introduced in version 4.7.9 for CVE-2026-33937. An attacker who can | supply an object instead of a template string can place JavaScript | expressions in unchecked values such as Program.blockParams.length, | a non-PathExpression parameter depth, a non-string | StringLiteral.value, or a non-string PathExpression.original. The | compiler emits those values into generated JavaScript, causing code | execution in the server process when compile output renders or | wherever precompile output is loaded. Applications that pass only | template strings are not affected. This issue is fixed in version | 4.7.10. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-106444 https://www.cve.org/CVERecord?id=CVE-2026-106444 [1] https://security-tracker.debian.org/tracker/CVE-2026-106445 https://www.cve.org/CVERecord?id=CVE-2026-106445 [2] https://security-tracker.debian.org/tracker/CVE-2026-106446 https://www.cve.org/CVERecord?id=CVE-2026-106446 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]