[devin-ai-integration]

Problem

package.json pinned hbs@^4.0.4, which resolves handlebars@4.0.14. That version lets a template reach __proto__ / __defineGetter__ / constructor on the context object (SNYK-JS-HANDLEBARS-173692, CWE-1321, CVSS 7.3), which can escalate to arbitrary code execution on the server. The hbs engine renders views/layout.hbs and views/account.hbs (app.js:26, routes/index.js).

Fix

Bump hbs to 4.2.1 (the smallest hbs that pins handlebars@4.7.9, well above the 4.1.2 fix line) plus the matching package-lock.json. Lockfile-only change otherwise; no application code touched, so the committed sarif.json line anchors are unaffected.

Also clears, on the hbs path: SNYK-JS-HANDLEBARS-534988, SNYK-JS-HANDLEBARS-480388, SNYK-JS-HANDLEBARS-1056767 and CVE-2026-33937/33938/33939/33941. The dev-only tap@11 > nyc@11 > istanbul-reports > handlebars@4.0.11 path is bundled by nyc and needs a separate tap major bump.

Verification (offline — api.snyk.io and the Snyk CLI are blocked in this environment, so no rescan)

npm ci in a worktree of this branch resolves hbs@4.2.1 / handlebars@4.7.9.

Prototype-access PoC (node poc.js <checkout> <label>):

== [main] handlebars 4.0.14
VULNERABLE __defineGetter__ access: "function __defineGetter__() { [native code] }"
== [fix] handlebars 4.7.9
blocked    __defineGetter__ access: ""
Handlebars: Access has been denied to resolve the property "split" because it is not an "own property" of its parent.

Render smoke test with the real app.js (in-memory Mongo stand-in): login, GET /account_details and a legit POST /account_details all render the normal layout with the submitted values intact on 4.7.9.

Note: the separate client-controlled layout parameter traversal on /account_details is not fixed by this upgrade (tracked by sfind-e36d42c4 / #1106).

Finding: sfind-6f90225278874a7c9039f0106de1de1e

Per org policy this new finding gets its own PR; it duplicates the earlier hbs bumps (#642, #717, #742, #875) and only one should land.

Devin-Org: engineering

Link to Devin session: https://devin-gtm.devinenterprise.com/sessions/758e23ba61e74661a9eae26d025c3bed
Open in Devin Desktop: https://devin-gtm.devinenterprise.com/desktop/session/758e23ba61e74661a9eae26d025c3bed?variant=devin

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

Enable auto-review to review your pull requests automatically.

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	hbs@​4.0.4 ⏵ 4.2.1				-4

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.