Quick answers
- Is CVE-2019-19919 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-19919 being exploited in the wild.
- How severe is CVE-2019-19919?
- Low severity, with a CVSS score of 3.1, published 26 December 2019.
- Which products and versions are affected?
- bootstrap-wysihtml5-rails (RubyGems) ECOSYSTEM:introduced=0.3.3.5,last_affected=0.3.3.8.
- Is there a fix for CVE-2019-19919?
- A patch was published on 2019-12-26: Patches released for versions 3.0.8 and 4.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-19919 attacked?
- It is attacked over the network.
- Am I affected by CVE-2019-19919?
- Check whether you run bootstrap-wysihtml5-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a prototype pollution vulnerability (CWE-1321, CWE-74) in the Handlebars templating engine. Attackers can craft templates that modify __proto__ and __defineGetter__ properties on built-in JavaScript objects, achieving remote code execution. The vulnerability requires no authentication or user interaction—any template processing untrusted input is exploitable. The attack vector is network-based when templates are received from external sources. Patches are available: upgrade to handlebars 4.3.0 or later for 4.x versions, or 3.0.8 for 3.x versions.
Affected products
- Handlebars handlebars < 3.0.8, >= 4.0.0 < 4.3.0
- Nerian bootstrap-wysihtml5-rails 0.3.3.5 through 0.3.3.8
Identifiers
- CVE-2019-19919
- GHSA-w457-6q6x-cgp9
Timeline
- 2019-12-20: disclosed
- 2019-12-26: patched: Patches released for versions 3.0.8 and 4.3.0
- 2019-12-26: advisory