CVE-2019-19919

Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.3.0 handlebars versions prior to 3.0.8

Description The issue allows an attacker to execute arbitrary code through crafted payloads by altering an Object's proto and defineGetter properties. This is due to the lack of measures to neutralize special elements in the Handlebars templating engine. Templates may modify these properties, potentially leading to Remote Code Execution.

Recommendations For handlebars versions prior to 3.0.8, upgrade to version 3.0.8 or later. For handlebars versions prior to 4.3.0, upgrade to version 4.3.0 or later.