kritisch
CVE-2019-19919
nodejs-handlebars: prototype pollution leading to remote code execution via crafted payloads
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA, Ruby Advisory DB. Niedriger laut Red Hat (niedrig).
Beschreibung
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | kein Fix angegeben |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | kein Fix angegeben |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 und 35 weitere | 0 und 1 weitere |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | kein Fix angegeben |
| seal npm::Seal Security Database | @seal-security/handlebars, handlebars | 4.1.2-sp999 |
Alle 51 Einträge aus 13 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | kein Fix angegeben |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | kein Fix angegeben |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 19.4.0-r1 |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | kein Fix angegeben |
| seal npm::Seal Security Database | @seal-security/handlebars | 4.1.2-sp999 |
| seal npm::Seal Security Database | handlebars | 4.1.2-sp999 |
| wolfi | code-server | 0 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2019-19919
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919
- https://github.com/Nerian/bootstrap-wysihtml5-rails/blob/master/vendor/assets/javascripts/bootstrap-wysihtml5/handlebars.runtime.min.js
- https://github.com/Nerian/bootstrap-wysihtml5-rails/tree/master/vendor/assets/javascripts/bootstrap-wysihtml5
- https://github.com/advisories/GHSA-w457-6q6x-cgp9
- https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee
- https://github.com/handlebars-lang/handlebars.js/commit/90ad8d97ad2933852fb83fcc054699dc99e094db
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-wysihtml5-rails/CVE-2019-19919.yml
Alle 15 Referenzen
- https://github.com/wycats/handlebars.js
- https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc
- https://github.com/wycats/handlebars.js/issues/1558
- https://nvd.nist.gov/vuln/detail/CVE-2019-19919
- https://www.cve.org/CVERecord?id=CVE-2019-19919
- https://www.npmjs.com/advisories/1164
- https://www.tenable.com/security/tns-2021-14