https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 10:58:59 +0000 https://vulnerability.circl.lu/vuln/ghsa-7rx3-28cr-v5wh <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>The prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric `__lookupSetter__`. This omission is only exploitable when the non-default runtime option `allowProtoMethodsByDefault: true` is explicitly set — in that configuration `__lookupSetter__` becomes accessible while its counterparts remain blocked, creating an inconsistent security boundary.</p> <p>`4.6.0` is the version that introduced `protoAccessControl` and the `allowProtoMethodsByDefault` runtime option.</p> <p>## Description</p> <p>In `lib/handlebars/internal/proto-access.js`:</p> <p>```javascript const methodWhiteList = Object.create(null); methodWhiteList[&#39;constructor&#39;] = false; methodWhiteList[&#39;__defineGetter__&#39;] = false; methodWhiteList[&#39;__defineSetter__&#39;] = false; methodWhiteList[&#39;__lookupGetter__&#39;] = false; // __lookupSetter__ intentionally blocked in CVE-2021-23383, // but omitted here — creating an asymmetric blocklist ```</p> <p>All four legacy accessor helpers (`__defineGetter__`, `__defineSetter__`, `__lookupGetter__`, `__lookupSetter__`) were involved in the exploit chain addressed by CVE-2021-23383. Three of the four were explicitly blocked; `__lookupSetter__` was left out.</p> <p>When `allowProtoMethodsByDefault: true` is set, any prototype method **not present** in `methodWhiteList` is permitted by default. Because `__lookupSetter__` is absent from the list, it passes the `checkWhiteList` check…</p> <p><strong>Affected:</strong> npm: handlebars</p> <p>## Summary</p> <p>The prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric `__lookupSetter__`. This omission is only exploitable when the non-default runtime option `allowProtoMethodsByDefault: true` is explicitly set — in that configuration `__lookupSetter__` becomes accessible while its counterparts remain blocked, creating an inconsistent security boundary.</p> <p>`4.6.0` is the version that introduced `protoAccessControl` and the `allowProtoMethodsByDefault` runtime option.</p> <p>## Description</p> <p>In `lib/handlebars/internal/proto-access.js`:</p> <p>```javascript const methodWhiteList = Object.create(null); methodWhiteList[&#39;constructor&#39;] = false; methodWhiteList[&#39;__defineGetter__&#39;] = false; methodWhiteList[&#39;__defineSetter__&#39;] = false; methodWhiteList[&#39;__lookupGetter__&#39;] = false; // __lookupSetter__ intentionally blocked in CVE-2021-23383, // but omitted here — creating an asymmetric blocklist ```</p> <p>All four legacy accessor helpers (`__defineGetter__`, `__defineSetter__`, `__lookupGetter__`, `__lookupSetter__`) were involved in the exploit chain addressed by CVE-2021-23383. Three of the four were explicitly blocked; `__lookupSetter__` was left out.</p> <p>When `allowProtoMethodsByDefault: true` is set, any prototype method **not present** in `methodWhiteList` is permitted by default. Because `__lookupSetter__` is absent from the list, it passes the `checkWhiteList` check…</p> https://vulnerability.circl.lu/vuln/ghsa-7rx3-28cr-v5wh