Handlebars' lookupProperty method, used from version 3.0.0 through 4.7.10, returns Function.prototype.constructor before the prototype‑access deny list is applied, because constructor is an own property of Function.prototype. An attacker who controls a template rendered with allowProtoMethodsByDefault enabled and can provide an accessible function object in the template context can traverse that function’s prototype chain to Function.prototype and obtain the Function constructor via the own‑property bypass. This enables the execution of attacker‑controlled JavaScript with the server application's privileges. The vulnerability has been fixed in version 4.7.10.

The vulnerability affects all installations of handlebars‑js from version 3.0.0 through 4.7.10. Any environment where user‑supplied templates are rendered with the allowProtoMethodsByDefault option enabled and where a function object is exposed in the template context is at risk. The issue is mitigated in version 4.7.10 and later releases.

With a CVSS score of 9.2 the vulnerability is classified as critical. The EPSS score of <1% indicates a very low but non‑zero exploitation probability, yet the fact that it is not listed in CISA’s KEV does not diminish the potential for attack in environments that allow dynamic template rendering. The attack requires an attacker to supply a crafted template and control the rendering configuration, making the vector an internal or web‑based template injection scenario. If triggered, it will execute arbitrary JavaScript on the server side.