GitHub Advisoryadvisory · npm, RubyGems

GHSA-w457-6q6x-cgp9 Prototype Pollution in handlebars

CRITICAL Published 2019-12-26 Modified 2022-06-06 Official page ↗
Aliases
CVE-2019-19919
Ecosystem
npm, RubyGems
Packages
handlebars, bootstrap-wysihtml5-rails
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-74
Reviewed
2019-12-26

Affected packages

• npm handlebars: >= 4.0.0, < 4.3.0 → fixed in 4.3.0 • RubyGems bootstrap-wysihtml5-rails: >= 0.3.3.5, <= 0.3.3.8 (no fix yet) • npm handlebars: < 3.0.8 → fixed in 3.0.8

Description

Versions of `handlebars` prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' `__proto__` and `__defineGetter__` properties, which may allow an attacker to execute arbitrary code through crafted payloads. Recommendation Upgrade to version 3.0.8, 4.3.0 or later.

Related

Alias · CVE (1)

  • CVE-2019-19919 Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References