Skip to content

Prototype Pollution in handlebars

Critical severity GitHub Reviewed Published Dec 26, 2019 to the GitHub Advisory Database • Updated Nov 29, 2023

Package

bundler bootstrap-wysihtml5-rails (RubyGems)

Affected versions

>= 0.3.3.5, <= 0.3.3.8

Patched versions

None
npm handlebars (npm)
>= 4.0.0, < 4.3.0
< 3.0.8
4.3.0
3.0.8
Published by the National Vulnerability Database Dec 20, 2019
Reviewed Dec 26, 2019
Published to the GitHub Advisory Database Dec 26, 2019
Last updated Nov 29, 2023

Severity

Critical
9.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE ID

CVE-2019-19919

GHSA ID

GHSA-w457-6q6x-cgp9

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.