CVE-2019-19919

Summary

CVE	CVE-2019-19919
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-12-20 23:15:00 UTC
Updated	2022-06-03 18:48:00 UTC
Description	Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Risk And Classification

Problem Types: CWE-1321

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Handlebars.js Project	Handlebars.js	1.0.10	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.11	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.12	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.6	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.7	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.8	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.9	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.1.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.1.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.1.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.2.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.2.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.3.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	2.0.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.3	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.4	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.5	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.6	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.7	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.10	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.11	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.12	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.13	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.14	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.3	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.4	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.5	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.6	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.7	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.8	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.9	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.1.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.1.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.1.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.2.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.2.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.2.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.10	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.11	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.12	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.6	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.7	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.8	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.0.9	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.1.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.1.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.1.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.2.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.2.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	1.3.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	2.0.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.3	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.4	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.5	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.6	-	All	All
Application	Handlebars.js Project	Handlebars.js	3.0.7	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.10	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.11	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.12	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.13	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.14	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.3	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.4	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.5	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.6	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.7	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.8	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.0.9	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.1.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.1.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.1.2	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.2.0	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.2.1	-	All	All
Application	Handlebars.js Project	Handlebars.js	4.2.2	-	All	All
Application	Tenable	Tenable.sc	All	All	All	All

References

Reference	Source	Link	Tags
Overview	MISC	www.npmjs.com	Third Party Advisory
[R1] Tenable.sc 5.19.0 Fixes Multiple Third-party Vulnerabilities - Security Advisory \| Tenable®	CONFIRM	www.tenable.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

375866 Node.js Handlebar Module Remote Code Execution Vulnerability
981982 Nodejs (npm) Security Update for handlebars (GHSA-w457-6q6x-cgp9)
996084 Rubygems (Rubygems) Security Update for bootstrap-wysihtml5-rails (GHSA-w457-6q6x-cgp9)