CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

CVE-2019-19919

CVE-2019-19919 affects the Node.js Handlebars package prior to 4.3.0. Root cause: a prototype pollution flaw that can alter Object.prototype properties, enabling an attacker to execute arbitrary code via crafted payloads (Remote Code Execution). Affected context includes Handlebars usage in serve...

CVE-2019-19919

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

CVE-2019-19919: Improperly Controlled Modification of Object Prototype Attributes

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads...

PT-2019-4634

Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.3.0 handlebars versions prior to 3.0.8 Description The issue allows an attacker to execute arbitrary code through crafted payloads by altering an Object's proto and defineGetter properties. This is due to the lac...

Arbitrary Code Execution

handlebars is vulnerable to arbitrary code execution. The lookup helper does not properly validate templates, allowing the execution of JavaScript code in templates. This vulnerability exists due to an incomplete fix for...

Prototype Pollution

handlebars is vulnerable to prototype pollution. A remote attacker is able to add or modify properties to the Object prototype using a malicious template, potentially allowing execution of arbitrary code...

Prototype Pollution

Overview Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions...

Arbitrary Code Execution

Overview Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a previo...

Arbitrary Code Execution

handlebars is vulnerable to arbitrary code execution. The vulnerability exists as the lookup helper does not properly validate templates, allowing the execution of JavaScript code in templates...

Arbitrary Code Execution

Overview Versions of handlebars prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a...

Denial Of Service (DoS)

handlebars is vulnerable to denial of service. A bug in matching of templates can cause an infinite loop due to greedy matching of raw-block-contents. This could potentially be abused by submitting malicious templates to cause a denial of service condition when system resources are exhausted...

Node.js third-party modules: Crash Node.js process from handlebars using a small and simple source

I would like to report Denial of service in handlebars. It allows an attacker to crush Node.js process with a small and simple source. Module module name: handlebars version: 4.5.1 npm page: https://www.npmjs.com/package/handlebars Module Description Handlebars.js is an extension to the Mustache...

Denial of Service

Overview Affected versions of handlebars are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service. Recommendation Upgrade to version...

Prototype Pollution

handlebars is vulnerable to prototype pollution. The vulnerability exists as it merges options.helpers, options.partials, and options.decorators...

Prototype Pollution

Overview Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads. Recommendation Upgrade...

Discourse < 2.3.0.beta9 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities in 3rdparty components. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

@behance/istanbul (0.3.17-sourcemap), @cmss/jslib (>=0.4.0, <=0.6.0) +219 more potentially affected by unknown CVE via handlebars (>=3.0.0, <=3.0.3)

handlebars NPM version =3.0.0, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 - arescli 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1075 more potentially affected by unknown CVE via handlebars (>=4.0.0, <=4.0.13)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =0.1.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...

@abeai/node-sdk (>=6.2.1-rc1, <=7.3.1), @after-work.js/aw (>=6.0.0-dev.20190228.0, <=6.0.5) +62 more potentially affected by unknown CVE via handlebars (>=4.1.0, <=4.1.1)

handlebars NPM version =4.1.0, =6.2.1-rc1, =6.0.0-dev.20190228.0, =6.0.0-dev.20190228.0, =0.0.41, =0.9.9, =0.4.0, =1.0.4, =0.2.6, =1.2.0-17d3c29f-b3, =1.0.0-beta.2, =3.9.4, =1.5.3, =7.0.0, =7.0.21 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...