CVE-2019-19919
CVE-2019-19919
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
CVSS 9.8 · Critical · EPSS 7.1% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
node-handlebars Debian:12
- Affected ranges
- ECOSYSTEM: < 3:4.5.3-1
Update to 3:4.5.3-1
node-handlebars Debian:13
- Affected ranges
- ECOSYSTEM: < 3:4.5.3-1
Update to 3:4.5.3-1
node-handlebars Debian:14
- Affected ranges
- ECOSYSTEM: < 3:4.5.3-1
Update to 3:4.5.3-1
handlebars npm
- Affected ranges
- SEMVER: ≥ 4.0.0, < 4.3.0
Update to 4.3.0
bootstrap-wysihtml5-rails RubyGems
- Versions
- 0.3.3.5
- 0.3.3.6
- 0.3.3.7
- 0.3.3.8
- Affected ranges
- ECOSYSTEM: ≥ 0.3.3.5, ≤ 0.3.3.8
No fix published
handlebars npm
- Affected ranges
- SEMVER: < 3.0.8
Update to 3.0.8
node-handlebars Ubuntu:18.04:LTS
- Versions
- 3:4.0.10-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published