[Pkg-javascript-devel] Bug#1150246: node-handlebars: CVE-2026-106444 CVE-2026-106445 CVE-2026-106446

[Salvatore Bonaccorso]

Source: node-handlebars
Version: 3:4.7.9-6
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerabilities were published for node-handlebars.

CVE-2026-106444[0]:
| Handlebars provides the power necessary to let users build semantic
| templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses
| quotedString() in lib/handlebars/compiler/code-gen.js to emit static
| template text into generated JavaScript without escaping sequences
| that terminate an enclosing HTML script element. When an application
| precompiles attacker-controlled template text and embeds the
| generated source directly in an inline script element, a closing
| script delimiter can end the element and cause following attacker-
| controlled markup to be parsed and executed. Ordinary server-side
| rendering and precompiled templates served as external JavaScript
| files are not affected. This issue is fixed in version 4.7.10.


CVE-2026-106445[1]:
| Handlebars provides the power necessary to let users build semantic
| templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty
| returns Function.prototype.constructor before applying the
| prototype-access deny list because constructor is an own property of
| Function.prototype. When an attacker can render a controlled
| template with allowProtoMethodsByDefault enabled and an accessible
| function in the template context, the template can traverse from
| that function through its prototype to Function.prototype and then
| obtain the Function constructor through the own-property bypass.
| This permits attacker-controlled JavaScript to execute with the
| server application's privileges. This issue is fixed in version
| 4.7.10.


CVE-2026-106446[2]:
| Handlebars provides the power necessary to let users build semantic
| templates. From 4.0.0 until 4.7.10, Handlebars.compile() and
| Handlebars.precompile() accept pre-parsed AST objects while
| validating only selected PathExpression, NumberLiteral, and
| BooleanLiteral values. This issue bypasses the AST validation
| introduced in version 4.7.9 for CVE-2026-33937. An attacker who can
| supply an object instead of a template string can place JavaScript
| expressions in unchecked values such as Program.blockParams.length,
| a non-PathExpression parameter depth, a non-string
| StringLiteral.value, or a non-string PathExpression.original. The
| compiler emits those values into generated JavaScript, causing code
| execution in the server process when compile output renders or
| wherever precompile output is loaded. Applications that pass only
| template strings are not affected. This issue is fixed in version
| 4.7.10.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-106444
    https://www.cve.org/CVERecord?id=CVE-2026-106444
[1] https://security-tracker.debian.org/tracker/CVE-2026-106445
    https://www.cve.org/CVERecord?id=CVE-2026-106445
[2] https://security-tracker.debian.org/tracker/CVE-2026-106446
    https://www.cve.org/CVERecord?id=CVE-2026-106446

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore