AIKIDO-2026-258160

TL;DR

lookupProperty in lib/handlebars/internal/proto-access.js returns a value as soon as Object.prototype.hasOwnProperty returns true, before the prototype method deny list runs. Because constructor is itself an own property of prototype objects, a template that reaches Function.prototype can retrieve Function and execute arbitrary JavaScript on the server. This applies to templates that use allowProtoMethodsByDefault: true and can reach any prototype object through an accessible function in the render context. The fix runs the deny list before returning an own property result.