CVE-2019-19999: Halo

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.

Affected products

• Halo Halo: up to and including 1.1.1; version 1.1.3 only; version 1.2.0 only

Published 2019-12-26. Last modified 2026-06-17.