CVE-2019-19919: Prototype Pollution in handlebars
Summary
CVE-2019-19919: Prototype Pollution in handlebars. Affects handlebars across 2 version ranges.
< 3.0.8
>= 4.0.0, < 4.3.0
Fixed in 3.0.8 or 4.3.0, depending on the release line you run. How to fix ↓
Also tracked for
- node-handlebars · Debian:11
The same CVE-2019-19919 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Handlebars is a popular JavaScript templating engine used for generating dynamic HTML content. It allows developers to create reusable templates with placeholders that can be filled with data to produce HTML output. However, versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution, a critical security issue that can lead to Remote Code Execution. This vulnerability allows templates to modify an object's __proto__ and __defineGetter__ properties, enabling an attacker to execute arbitrary code through crafted payloads.
Vulnerability Detail
The Prototype Pollution vulnerability in handlebars arises from the ability of templates to modify an object's __proto__ and __defineGetter__ properties. By manipulating these properties, an attacker can inject malicious code into the application, leading to Remote Code Execution. This can have severe consequences, including unauthorized access to sensitive data, system compromise, and further exploitation of the affected application.
How To Fix
Latest published version: 4.7.10 as of 22 Oct 2026
npm install handlebars@4.7.10Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.0.83.0.8npm install handlebars@3.0.8 -
>= 4.0.0, < 4.3.04.3.0npm install handlebars@4.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched versions of handlebars to mitigate the risk of exploitation.
Conclusion
The Prototype Pollution vulnerability in handlebars can have severe consequences, including Remote Code Execution and unauthorized access to sensitive data. It is essential to update to version 3.0.8, 4.3.0, or any later release of handlebars to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for handlebars →
FAQ
Handlebars is a JavaScript templating engine used for generating dynamic HTML content.
Prototype Pollution is a vulnerability that allows an attacker to modify an object's prototype, leading to unexpected behavior and potential security issues.
The consequences of this vulnerability include Remote Code Execution, unauthorized access to sensitive data, system compromise, and further exploitation of the affected application.
To fix this vulnerability, it is recommended to upgrade to version 3.0.8, 4.3.0, or any later release of handlebars.
There is no known workaround for this vulnerability. It is crucial to update to the patched versions of handlebars to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for handlebars.
