Time-of-check Time-of-use (TOCTOU) Race Condition Affecting org.webjars.npm:handlebars package, versions [,4.7.9)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGWEBJARSNPM-15813001
- published30 Mar 2026
- disclosed29 Mar 2026
- creditLetaoZhao
Introduced: 29 Mar 2026
CVE NOT AVAILABLE CWE-367 (opens in a new tab)How to fix?
Upgrade org.webjars.npm:handlebars to version 4.7.9 or higher.
Overview
org.webjars.npm:handlebars is an extension to the Mustache templating language.
Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the lookup function. An attacker can access properties that should be restricted by bypassing prototype-access controls through a time-of-check time-of-use (TOCTOU) flaw, where the security check and the actual property access are decoupled.
Note: This is only exploitable if the { compat: true } compile option is enabled.
Workaround
This vulnerability can be mitigated by avoiding the { compat: true } option and ensuring context data objects are plain JSON without Proxies or getter-based accessor properties.