Read the docs
TI-2019-14365 Aliases CVE-2019-19919GHSA-w457-6q6x-cgp9

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to…

Priority MEDIUM 52CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Why it matters now

EPSS 0.07066 94th percentileScored 2026-11-07
Fix Partial handlebars (npm): 4.3.0, 3.0.8Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—handlebars (npm)4.0.0 to before 4.3.04.3.0Patch availableGHSA-w457-6q6x-cgp9
—bootstrap-wysihtml5-rails (RubyGems)0.3.3.5 – 0.3.3.8—No fix listedGHSA-w457-6q6x-cgp9
—handlebars (npm)before 3.0.83.0.8Patch availableGHSA-w457-6q6x-cgp9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • handlebars (npm) Vendor— Affected 4.0.0 to before 4.3.0 Fixed in 4.3.0 Patch available GHSA-w457-6q6x-cgp9
  • bootstrap-wysihtml5-rails (RubyGems) Vendor— Affected 0.3.3.5 – 0.3.3.8 Fixed in — No fix listed GHSA-w457-6q6x-cgp9
  • handlebars (npm) Vendor— Affected before 3.0.8 Fixed in 3.0.8 Patch available GHSA-w457-6q6x-cgp9

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.6:-:*:*:*:node.js:*:*1.0.6VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.7:-:*:*:*:node.js:*:*1.0.7VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.8:-:*:*:*:node.js:*:*1.0.8VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.9:-:*:*:*:node.js:*:*1.0.9VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.10:-:*:*:*:node.js:*:*1.0.10VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.11:-:*:*:*:node.js:*:*1.0.11VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.12:-:*:*:*:node.js:*:*1.0.12VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.1.0:-:*:*:*:node.js:*:*1.1.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.1.1:-:*:*:*:node.js:*:*1.1.1VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.1.2:-:*:*:*:node.js:*:*1.1.2VulnerableHandlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.6:-:*:*:*:node.js:*:* Versions 1.0.6 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.7:-:*:*:*:node.js:*:* Versions 1.0.7 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.8:-:*:*:*:node.js:*:* Versions 1.0.8 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.9:-:*:*:*:node.js:*:* Versions 1.0.9 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.10:-:*:*:*:node.js:*:* Versions 1.0.10 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.11:-:*:*:*:node.js:*:* Versions 1.0.11 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.0.12:-:*:*:*:node.js:*:* Versions 1.0.12 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.1.0:-:*:*:*:node.js:*:* Versions 1.1.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.1.1:-:*:*:*:node.js:*:* Versions 1.1.1 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.1.2:-:*:*:*:node.js:*:* Versions 1.1.2 Vulnerable ·Handlebars.js Project
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:handlebars.js_project:handlebars.js:1.2.0:-:*:*:*:node.js:*:*1.2.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.2.1:-:*:*:*:node.js:*:*1.2.1VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:1.3.0:-:*:*:*:node.js:*:*1.3.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:2.0.0:-:*:*:*:node.js:*:*2.0.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.0:-:*:*:*:node.js:*:*3.0.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.1:-:*:*:*:node.js:*:*3.0.1VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.2:-:*:*:*:node.js:*:*3.0.2VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.3:-:*:*:*:node.js:*:*3.0.3VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.4:-:*:*:*:node.js:*:*3.0.4VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.5:-:*:*:*:node.js:*:*3.0.5VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.6:-:*:*:*:node.js:*:*3.0.6VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.7:-:*:*:*:node.js:*:*3.0.7VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.0:-:*:*:*:node.js:*:*4.0.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.1:-:*:*:*:node.js:*:*4.0.1VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.2:-:*:*:*:node.js:*:*4.0.2VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.3:-:*:*:*:node.js:*:*4.0.3VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.4:-:*:*:*:node.js:*:*4.0.4VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.5:-:*:*:*:node.js:*:*4.0.5VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.6:-:*:*:*:node.js:*:*4.0.6VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.7:-:*:*:*:node.js:*:*4.0.7VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.8:-:*:*:*:node.js:*:*4.0.8VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.9:-:*:*:*:node.js:*:*4.0.9VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.10:-:*:*:*:node.js:*:*4.0.10VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.11:-:*:*:*:node.js:*:*4.0.11VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.12:-:*:*:*:node.js:*:*4.0.12VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.13:-:*:*:*:node.js:*:*4.0.13VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.14:-:*:*:*:node.js:*:*4.0.14VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.1.0:-:*:*:*:node.js:*:*4.1.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.1.1:-:*:*:*:node.js:*:*4.1.1VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.1.2:-:*:*:*:node.js:*:*4.1.2VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.2.0:-:*:*:*:node.js:*:*4.2.0VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.2.1:-:*:*:*:node.js:*:*4.2.1VulnerableHandlebars.js Project
cpe:2.3:a:handlebars.js_project:handlebars.js:4.2.2:-:*:*:*:node.js:*:*4.2.2VulnerableHandlebars.js Project
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*before 5.19.0VulnerableTenable
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.2.0:-:*:*:*:node.js:*:* Versions 1.2.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.2.1:-:*:*:*:node.js:*:* Versions 1.2.1 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:1.3.0:-:*:*:*:node.js:*:* Versions 1.3.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:2.0.0:-:*:*:*:node.js:*:* Versions 2.0.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.0:-:*:*:*:node.js:*:* Versions 3.0.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.1:-:*:*:*:node.js:*:* Versions 3.0.1 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.2:-:*:*:*:node.js:*:* Versions 3.0.2 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.3:-:*:*:*:node.js:*:* Versions 3.0.3 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.4:-:*:*:*:node.js:*:* Versions 3.0.4 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.5:-:*:*:*:node.js:*:* Versions 3.0.5 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.6:-:*:*:*:node.js:*:* Versions 3.0.6 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:3.0.7:-:*:*:*:node.js:*:* Versions 3.0.7 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.0:-:*:*:*:node.js:*:* Versions 4.0.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.1:-:*:*:*:node.js:*:* Versions 4.0.1 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.2:-:*:*:*:node.js:*:* Versions 4.0.2 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.3:-:*:*:*:node.js:*:* Versions 4.0.3 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.4:-:*:*:*:node.js:*:* Versions 4.0.4 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.5:-:*:*:*:node.js:*:* Versions 4.0.5 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.6:-:*:*:*:node.js:*:* Versions 4.0.6 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.7:-:*:*:*:node.js:*:* Versions 4.0.7 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.8:-:*:*:*:node.js:*:* Versions 4.0.8 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.9:-:*:*:*:node.js:*:* Versions 4.0.9 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.10:-:*:*:*:node.js:*:* Versions 4.0.10 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.11:-:*:*:*:node.js:*:* Versions 4.0.11 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.12:-:*:*:*:node.js:*:* Versions 4.0.12 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.13:-:*:*:*:node.js:*:* Versions 4.0.13 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.14:-:*:*:*:node.js:*:* Versions 4.0.14 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.1.0:-:*:*:*:node.js:*:* Versions 4.1.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.1.1:-:*:*:*:node.js:*:* Versions 4.1.1 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.1.2:-:*:*:*:node.js:*:* Versions 4.1.2 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.2.0:-:*:*:*:node.js:*:* Versions 4.2.0 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.2.1:-:*:*:*:node.js:*:* Versions 4.2.1 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:handlebars.js_project:handlebars.js:4.2.2:-:*:*:*:node.js:*:* Versions 4.2.2 Vulnerable ·Handlebars.js Project
  • cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions before 5.19.0 Vulnerable ·Tenable

Remediation

  • Fix · GHSA-w457-6q6x-cgp9 handlebars (npm) Fixed in 4.3.0 Advisory →
  • Fix · GHSA-w457-6q6x-cgp9 handlebars (npm) Fixed in 3.0.8 Advisory →

Red Hat 1 advisory

  • RHSA-2023:1334 Released 2023-03-20 · Red Hat rating Critical
    Red Hat Process Automation Manager 7.13.2 security update
    • RHPAM 7.13.1 async

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
RHPAM 7.13.1 asyncFixed RHSA-2023:1334

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19919
  2. 2026-10-03 Alias added: GHSA-w457-6q6x-cgp9

References

Patch 1

Advisory 2

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences