Your message dated Wed, 07 Oct 2026 17:19:05 +0000
with message-id <[email protected]>
and subject line Bug#1150246: fixed in node-handlebars 3:4.7.10-1
has caused the Debian Bug report #1150246,
regarding node-handlebars: CVE-2026-106444 CVE-2026-106445 CVE-2026-106446
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150246: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150246
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-handlebars
Version: 3:4.7.9-6
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerabilities were published for node-handlebars.
CVE-2026-106444[0]:
| Handlebars provides the power necessary to let users build semantic
| templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses
| quotedString() in lib/handlebars/compiler/code-gen.js to emit static
| template text into generated JavaScript without escaping sequences
| that terminate an enclosing HTML script element. When an application
| precompiles attacker-controlled template text and embeds the
| generated source directly in an inline script element, a closing
| script delimiter can end the element and cause following attacker-
| controlled markup to be parsed and executed. Ordinary server-side
| rendering and precompiled templates served as external JavaScript
| files are not affected. This issue is fixed in version 4.7.10.
CVE-2026-106445[1]:
| Handlebars provides the power necessary to let users build semantic
| templates. From 4.0.0 until 4.7.10, Handlebars lookupProperty
| returns Function.prototype.constructor before applying the
| prototype-access deny list because constructor is an own property of
| Function.prototype. When an attacker can render a controlled
| template with allowProtoMethodsByDefault enabled and an accessible
| function in the template context, the template can traverse from
| that function through its prototype to Function.prototype and then
| obtain the Function constructor through the own-property bypass.
| This permits attacker-controlled JavaScript to execute with the
| server application's privileges. This issue is fixed in version
| 4.7.10.
CVE-2026-106446[2]:
| Handlebars provides the power necessary to let users build semantic
| templates. From 4.0.0 until 4.7.10, Handlebars.compile() and
| Handlebars.precompile() accept pre-parsed AST objects while
| validating only selected PathExpression, NumberLiteral, and
| BooleanLiteral values. This issue bypasses the AST validation
| introduced in version 4.7.9 for CVE-2026-33937. An attacker who can
| supply an object instead of a template string can place JavaScript
| expressions in unchecked values such as Program.blockParams.length,
| a non-PathExpression parameter depth, a non-string
| StringLiteral.value, or a non-string PathExpression.original. The
| compiler emits those values into generated JavaScript, causing code
| execution in the server process when compile output renders or
| wherever precompile output is loaded. Applications that pass only
| template strings are not affected. This issue is fixed in version
| 4.7.10.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-106444
https://www.cve.org/CVERecord?id=CVE-2026-106444
[1] https://security-tracker.debian.org/tracker/CVE-2026-106445
https://www.cve.org/CVERecord?id=CVE-2026-106445
[2] https://security-tracker.debian.org/tracker/CVE-2026-106446
https://www.cve.org/CVERecord?id=CVE-2026-106446
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-handlebars
Source-Version: 3:4.7.10-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-handlebars, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-handlebars package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 07 Oct 2026 18:59:01 +0200
Source: node-handlebars
Architecture: source
Version: 3:4.7.10-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1150246
Changes:
node-handlebars (3:4.7.10-1) unstable; urgency=medium
.
* Team upload
* New upstream version
(Closes: #1150246, CVE-2026-106444, CVE-2026-106445, CVE-2026-106446)
* Unfuzz patches
Checksums-Sha1:
62a988e63f328e506e2380875ef48b6a9a6a3aa3 2701 node-handlebars_4.7.10-1.dsc
63705fefad2c457ac6c8301c09cf51351d73edf8 239436
node-handlebars_4.7.10.orig.tar.gz
59ab997bd7f2b1b65e0894101246d264798adfc4 61628
node-handlebars_4.7.10-1.debian.tar.xz
Checksums-Sha256:
aedd8f3812cc1b7c6b7d84e028d8301fe851f9f20f2fa32829ec549d3405f157 2701
node-handlebars_4.7.10-1.dsc
07020f7e9e880e10c4652ed349d798deb14e2977919844fbeeb31f3164f886e9 239436
node-handlebars_4.7.10.orig.tar.gz
b5853ef43744fa24848f03d2bcfd95cfad8a9cb0ee569027a29f0d6cd481db56 61628
node-handlebars_4.7.10-1.debian.tar.xz
Files:
95dda72546ee27cd617854c95e296d4e 2701 javascript optional
node-handlebars_4.7.10-1.dsc
d56b99f6961f04f9480b6c418a5ffede 239436 javascript optional
node-handlebars_4.7.10.orig.tar.gz
a8e44dee51c96fc45a8b6cd3a3b20cb9 61628 javascript optional
node-handlebars_4.7.10-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrGesoACgkQ9tdMp8mZ
7un5CA//bK2MbpK6WiVKO8qwE1oPN9MvU1KUQuCiLwkbWOZ+zjbMEM/Xsj4KRnRJ
G0bWH+E6V6JnmIO8sz5G7ZZSKc0aFLBVUqxEpucGGPXQruRXA9aGiNwo2I/fJ1Qi
d//BQ1WbbsNzfSnCC4z/87pGKSyigAe+xBK1xjD0TNZmVDi5mrplENrcXzuxI62f
WGkgsRVkD/CjH38H72ypExnm2HqE3Aa+NGGq5RJ9E1r1SASsP125147c+oLGbB5c
j1gKoNrmipm6617Kab+gHlVJyHU8tEYVNBgz1ew4YLNFMBfgU+Brys50UfSMwVYo
LX1ZB9xQ9uOIMEMSOkyVBWqocqrP/ogZ0QIbzA8b4MxnRXay4tSJNWpiV3hrxG9L
P9l4lmOWtZg1EBXoY/JPzx0aiT5YkQBvzHWawgTY7M6lsln9yC/9/N+RHK2s90z6
KAuhfICdtAlFewiukMwb6/uHNsiLgVrw/w1WiY38C9KZlSZtX45LPx0hOn9tBJYm
OpeFVuVTk/u4qOfCVEznYH9u2elKna+zuaiMq0zSKKmHAfz08ErXV6+E0lUP1Nbp
Zk1pcWxOd6WbNJScOxTh28ncBM+5FqIv7KzTHYw7tx/boAytEhoOftu0k8zOLZCI
5v3LHO3CmCqbfgBgZJeqOHQNYjQuMxZd28n1FAtiSQ2S6sYfFD8=
=kaE0
-----END PGP SIGNATURE-----
pgpJ3UgTZgNfh.pgp
Description: PGP signature
--- End Message ---
