kritik
CVE-2019-19919
nodejs-handlebars: prototype pollution leading to remote code execution via crafted payloads
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Ruby Advisory DB. Daha düşük diyenler: Red Hat (düşük).
Açıklama
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | düzeltme belirtilmemiş |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | düzeltme belirtilmemiş |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 ve 35 tane daha | 0 ve 1 tane daha |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | düzeltme belirtilmemiş |
| seal npm::Seal Security Database | @seal-security/handlebars, handlebars | 4.1.2-sp999 |
13 kaynaktaki 51 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| npm::GitHub Security Advisory npm | handlebars | 4.3.0, 3.0.8 |
| rubygems::GitHub Security Advisory RubyGems | bootstrap-wysihtml5-rails | düzeltme belirtilmemiş |
| rubygems::Ruby Advisory Database | bootstrap-wysihtml5-rails | düzeltme belirtilmemiş |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 19.4.0-r1 |
| debian 10 | node-handlebars | 3:4.1.0-1+deb10u1 |
| debian 11 | node-handlebars | 3:4.5.3-1 |
| debian 12 | node-handlebars | 3:4.5.3-1 |
| debian 13 | node-handlebars | 3:4.5.3-1 |
| debian 14 | node-handlebars | 3:4.5.3-1 |
| echo | node-handlebars | 3:4.5.3-1 |
| Red Hat | kibana | düzeltme belirtilmemiş |
| seal npm::Seal Security Database | @seal-security/handlebars | 4.1.2-sp999 |
| seal npm::Seal Security Database | handlebars | 4.1.2-sp999 |
| wolfi | code-server | 0 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2019-19919
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919
- https://github.com/Nerian/bootstrap-wysihtml5-rails/blob/master/vendor/assets/javascripts/bootstrap-wysihtml5/handlebars.runtime.min.js
- https://github.com/Nerian/bootstrap-wysihtml5-rails/tree/master/vendor/assets/javascripts/bootstrap-wysihtml5
- https://github.com/advisories/GHSA-w457-6q6x-cgp9
- https://github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2bdaac029ee
- https://github.com/handlebars-lang/handlebars.js/commit/90ad8d97ad2933852fb83fcc054699dc99e094db
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-wysihtml5-rails/CVE-2019-19919.yml
15 referansın hepsi
- https://github.com/wycats/handlebars.js
- https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc
- https://github.com/wycats/handlebars.js/issues/1558
- https://nvd.nist.gov/vuln/detail/CVE-2019-19919
- https://www.cve.org/CVERecord?id=CVE-2019-19919
- https://www.npmjs.com/advisories/1164
- https://www.tenable.com/security/tns-2021-14