critique
CVE-2019-19919
nodejs-handlebars: prototype pollution leading to remote code execution via crafted payloads
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Ruby Advisory DB. Plus basse selon Red Hat (faible).
Description
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | pas de correctif indiqué |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | pas de correctif indiqué |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 et 35 autres | 0 et 1 autres |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | pas de correctif indiqué |
| seal npm::Seal Security Database | @seal-security/handlebars, handlebars | 4.1.2-sp999 |
Afficher les 51 entrées de 13 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | pas de correctif indiqué |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | pas de correctif indiqué |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 19.4.0-r1 |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | pas de correctif indiqué |
| seal npm::Seal Security Database | @seal-security/handlebars | 4.1.2-sp999 |
| seal npm::Seal Security Database | handlebars | 4.1.2-sp999 |
| wolfi | code-server | 0 |
Références
- https://access.redhat.com/security/cve/CVE-2019-19919
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919
- https://github.com/Nerian/bootstrap-wysihtml5-rails/blob/master/vendor/assets/javascripts/bootstrap-wysihtml5/handlebars.runtime.min.js
- https://github.com/Nerian/bootstrap-wysihtml5-rails/tree/master/vendor/assets/javascripts/bootstrap-wysihtml5
- https://github.com/advisories/GHSA-w457-6q6x-cgp9
- https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee
- https://github.com/handlebars-lang/handlebars.js/commit/90ad8d97ad2933852fb83fcc054699dc99e094db
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-wysihtml5-rails/CVE-2019-19919.yml
Les 15 références
- https://github.com/wycats/handlebars.js
- https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc
- https://github.com/wycats/handlebars.js/issues/1558
- https://nvd.nist.gov/vuln/detail/CVE-2019-19919
- https://www.cve.org/CVERecord?id=CVE-2019-19919
- https://www.npmjs.com/advisories/1164
- https://www.tenable.com/security/tns-2021-14