# CVE-2019-19919: Handlebars prototype pollution remote code execution

Source: https://junglewise.ai/threats/cve-2019-19919-handlebars-prototype-pollution-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-12-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-19919 · Severity: low · CVSS 3.1 · Published 2019-12-26

Handlebars is a popular JavaScript templating engine used in web applications and build systems. Versions prior to 4.3.0 (and 3.0.8 for the 3.x line) allow malicious templates to modify JavaScript's core prototype objects, enabling attackers to execute arbitrary code on any system processing the template. This affects all applications using vulnerable handlebars versions.

Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2019-19919 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-19919 being exploited in the wild.

**How severe is CVE-2019-19919?** Low severity, with a CVSS score of 3.1, published 26 December 2019.

**Which products and versions are affected?** bootstrap-wysihtml5-rails (RubyGems) ECOSYSTEM:introduced=0.3.3.5,last_affected=0.3.3.8.

**Is there a fix for CVE-2019-19919?** A patch was published on 2019-12-26: Patches released for versions 3.0.8 and 4.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-19919 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-19919?** Check whether you run bootstrap-wysihtml5-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a prototype pollution vulnerability (CWE-1321, CWE-74) in the Handlebars templating engine. Attackers can craft templates that modify __proto__ and __defineGetter__ properties on built-in JavaScript objects, achieving remote code execution. The vulnerability requires no authentication or user interaction—any template processing untrusted input is exploitable. The attack vector is network-based when templates are received from external sources. Patches are available: upgrade to handlebars 4.3.0 or later for 4.x versions, or 3.0.8 for 3.x versions.

## Affected products

- Handlebars handlebars < 3.0.8, >= 4.0.0 < 4.3.0
- Nerian bootstrap-wysihtml5-rails 0.3.3.5 through 0.3.3.8

## Identifiers

- CVE-2019-19919
- GHSA-w457-6q6x-cgp9

## Timeline

- 2019-12-20: disclosed
- 2019-12-26: patched: Patches released for versions 3.0.8 and 4.3.0
- 2019-12-26: advisory

## References

- [https://github.com/wycats/handlebars.js/issues/1558](https://github.com/wycats/handlebars.js/issues/1558)