GHSA-w457-6q6x-cgp9 CVE-2019-19919
Prototype Pollution in handlebars
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 7.07%
- Chance of exploitation in the next 30 days. Higher than 94.21% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
4.3.0- Upgrade handlebars to this version or later
Description
Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Recommendation
Upgrade to version 3.0.8, 4.3.0 or later.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| bootstrap-wysihtml5-rails | >= 0.3.3.5, <= 0.3.3.8 |
No fix yet |
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| handlebars | >= 4.0.0, < 4.3.0 |
4.3.0 |
| handlebars | < 3.0.8 |
3.0.8 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
handlebars npm → 4.3.0
- npm
npm install handlebars@4.3.0- yarn
yarn add handlebars@4.3.0- pnpm
pnpm add handlebars@4.3.0
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
How to prevent it
- Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
- Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
- Implementation: When handling untrusted objects, validating using a schema can be used.
- Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
- Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Advisories
Packages
Other links
- github.com/wycats/handlebars.js/issues/1558
- github.com/handlebars-lang/handlebars.js/commit/156061eb7707575293613d7fdf90e2b…
- github.com/handlebars-lang/handlebars.js/commit/90ad8d97ad2933852fb83fcc054699d…
- github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc
- cve.mitre.org/cgi-bin/cvename.cgi
- github.com/Nerian/bootstrap-wysihtml5-rails/blob/master/vendor/assets/javascrip…
- github.com/Nerian/bootstrap-wysihtml5-rails/tree/master/vendor/assets/javascrip…
- github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-wysihtml5-rails/…
- tenable.com/security/tns-2021-14
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8r5x-fm3f-whwj Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) | Critical | Also affects handlebars |
| GHSA-p8wg-vrv2-v86f Handlebars: JavaScript Injection via Own Property Check Bypass | Critical | Also affects handlebars |
| GHSA-xw65-4hp5-5hc7 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | Medium | Also affects handlebars |
| GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry | Medium | Also affects handlebars |
| GHSA-442j-39wm-28r2 Handlebars.js has a Property Access Validation Bypass in container.lookup | Low | Also affects handlebars |
| GHSA-xjpj-3mr7-gcpf Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | High | Also affects handlebars |
| GHSA-xhpv-hc6g-r9c6 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | High | Also affects handlebars |
| GHSA-9cx6-37pm-9jff Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | High | Also affects handlebars |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor