---
title: "Handlebars – Remote-code-execution Exploits Where Misusing prototype-builtins On Versions Under 4.5.3"
description: "**Impact area** Security **Severity** High **Affected element** **ServiceNow** UI Script **Salesforce** Static Resource ## Rule number **SN-JSL-HANDLEBARS-LESSTHAN-V453 **(for ServiceNow) **SF-JSL-HANDLEBARS-LESSTHAN-V453 **(for Salesforce) ## Impact The properties __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ have been added to the list of \"properties that must be…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/handlebars-remote-code-execution-exploits-where-misusing-prototype-builtins-on-versions-under-4-5-3/"
updated: "2025-03-21"
category: Rules
---

# Handlebars – Remote-code-execution Exploits Where Misusing prototype-builtins On Versions Under 4.5.3

**Impact area**

Security

**Severity**

High

**Affected element**

**ServiceNow**

UI Script

**Salesforce**

Static Resource

## Rule number

**SN-JSL-HANDLEBARS-LESSTHAN-V453 **(for ServiceNow)

**SF-JSL-HANDLEBARS-LESSTHAN-V453 **(for Salesforce)

## Impact

The properties __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ have been added to the list of "properties that must be enumerable". If a property by that name is found and not enumerable on its parent, it will silently evaluate to undefined. This is done in both the compiled template and the "lookup"-helper. This will prevent new Remote-Code-Execution exploits that have been published recently.

Remediation

Update the Handlebars JS library to the latest version.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html).