crítica
CVE-2019-19919
nodejs-handlebars: prototype pollution leading to remote code execution via crafted payloads
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Ruby Advisory DB. Más baja según Red Hat (baja).
Descripción
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | sin corrección indicada |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | sin corrección indicada |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 y 35 más | 0 y 1 más |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | sin corrección indicada |
| seal npm::Seal Security Database | @seal-security/handlebars, handlebars | 4.1.2-sp999 |
Mostrar las 51 entradas de 13 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | sin corrección indicada |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | sin corrección indicada |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 19.4.0-r1 |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | sin corrección indicada |
| seal npm::Seal Security Database | @seal-security/handlebars | 4.1.2-sp999 |
| seal npm::Seal Security Database | handlebars | 4.1.2-sp999 |
| wolfi | code-server | 0 |
Referencias
- https://access.redhat.com/security/cve/CVE-2019-19919
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919
- https://github.com/Nerian/bootstrap-wysihtml5-rails/blob/master/vendor/assets/javascripts/bootstrap-wysihtml5/handlebars.runtime.min.js
- https://github.com/Nerian/bootstrap-wysihtml5-rails/tree/master/vendor/assets/javascripts/bootstrap-wysihtml5
- https://github.com/advisories/GHSA-w457-6q6x-cgp9
- https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee
- https://github.com/handlebars-lang/handlebars.js/commit/90ad8d97ad2933852fb83fcc054699dc99e094db
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-wysihtml5-rails/CVE-2019-19919.yml
Las 15 referencias
- https://github.com/wycats/handlebars.js
- https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc
- https://github.com/wycats/handlebars.js/issues/1558
- https://nvd.nist.gov/vuln/detail/CVE-2019-19919
- https://www.cve.org/CVERecord?id=CVE-2019-19919
- https://www.npmjs.com/advisories/1164
- https://www.tenable.com/security/tns-2021-14