CVE-2019-19919
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto_...
Summary
Prototype Pollution in handlebars
Original description
The description as published by the source.
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
handlebars
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]
RubyGems
bootstrap-wysihtml5-rails
[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.3.5"},{"last_affected":"0.3.3.8"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2019-19919 node-handlebars Fixed in: 3:4.5.3-1
References
- advisory nvd.nist.gov
- advisory npmjs.com
- package github.com
- patch tenable.com
- web github.com
- web github.com
- web github.com
- web github.com
- web cve.mitre.org
- web github.com
- web github.com
- web github.com