GHSA-7rx3-28cr-v5wh: Handlebars Handlebars.js Has A Prototype Method Vulnerability
MODERATEGHSA-7rx3-28cr-v5wh is a MODERATE (CVSS 4.8) handlebars.js has a prototype method vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')) affecting Handlebars libraries in the npm ecosystem. The issue involves handlebars.js has a prototype method access control gap via missing __lookupsetter__ blocklist entry. Remediation is available by upgrading affected packages to version 4.7.9.
GHSA-7rx3-28cr-v5wh at a Glance
Security Impact
CVSS: 4.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
How to Fix GHSA-7rx3-28cr-v5wh
To remediate this vulnerability, upgrade all affected Handlebars dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install handlebars@4.7.9Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls handlebarsHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-7rx3-28cr-v5wh, inspect your project dependencies using npm:
npm ls handlebarsAnalyze the terminal output to locate any version of Handlebars in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.7.9), your application is affected.
Note: The npm ls handlebars command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), where the product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. In Handlebars, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-7rx3-28cr-v5wh Affected Handlebars Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
handlebars
|
npm |
≥ 4.6.0
< 4.7.9
|
4.7.9
|
References
Frequently Asked Questions
What is GHSA-7rx3-28cr-v5wh?
Which Handlebars versions are affected?
What version fixes GHSA-7rx3-28cr-v5wh?
Is handlebars affected?
What is the CVSS score of GHSA-7rx3-28cr-v5wh?
What CWE is associated with GHSA-7rx3-28cr-v5wh?
How can I check npm dependencies for GHSA-7rx3-28cr-v5wh?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7rx3-28cr-v5wh",
"modified" : "2026-03-29T15:17:15Z",
"published" : "2026-03-29T15:17:15Z",
"aliases" : [ ],
"summary" : "Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry",
"details" : "## Summary\n\nThe prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric `__lookupSetter__`. This omission is only exploitable when the non-default runtime option `allowProtoMethodsByDefault: true` is explicitly set — in that configuration `__lookupSetter__` becomes accessible while its counterparts remain blocked, creating an inconsistent security boundary.\n\n`4.6.0` is the version that introduced `protoAccessControl` and the `allowProtoMethodsByDefault` runtime option.\n\n## Description\n\nIn `lib/handlebars/internal/proto-access.js`:\n\n```javascript\nconst methodWhiteList = Object.create(null);\nmethodWhiteList['constructor'] = false;\nmethodWhiteList['__defineGetter__'] = false;\nmethodWhiteList['__defineSetter__'] = false;\nmethodWhiteList['__lookupGetter__'] = false;\n// __lookupSetter__ intentionally blocked in CVE-2021-23383,\n// but omitted here — creating an asymmetric blocklist\n```\n\nAll four legacy accessor helpers (`__defineGetter__`, `__defineSetter__`, `__lookupGetter__`, `__lookupSetter__`) were involved in the exploit chain addressed by CVE-2021-23383. Three of the four were explicitly blocked; `__lookupSetter__` was left out.\n\nWhen `allowProtoMethodsByDefault: true` is set, any prototype method **not present** in `methodWhiteList` is permitted by default. Because `__lookupSetter__` is absent from the list, it passes the `checkWhiteList` check and is accessible in templates, while `__lookupGetter__` (its sibling) is correctly denied.\n\n## Workarounds\n\n- Do **not** set `allowProtoMethodsByDefault: true`. The default configuration is not affected.\n- If `allowProtoMethodsByDefault` must be enabled, ensure templates do not reference `__lookupSetter__` through untrusted input.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "handlebars"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.6.0"
}, {
"fixed" : "4.7.9"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 4.7.8"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-7rx3-28cr-v5wh"
}, {
"type" : "ADVISORY",
"url" : "https://github.com/advisories/GHSA-765h-qjxv-5f44"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/handlebars-lang/handlebars.js"
}, {
"type" : "WEB",
"url" : "https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1321" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-29T15:17:15Z",
"nvd_published_at" : null
}
}