{"schema":"threatline.record/2","record":{"id":"CVE-2021-32822","aliases":["GHSA-7f5c-rpf4-86p8"],"summary":"hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor","details":"The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.","categories":["Libraries & packages"],"product":"hbs","vendor":"pillarjs","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-7f5c-rpf4-86p8","source_modified_at":"2026-10-27T16:09:59Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"npm","name":"hbs"},"range":"<= 4.4.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-32822","source_modified_at":"2024-08-03T23:33:55.940Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"hbs","vendor":"pillarjs","versions":[{"status":"affected","version":"all"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-7f5c-rpf4-86p8","source_modified_at":"2026-10-27T16:15:05.322069543Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"hbs","ecosystem":"npm","purl":"pkg:npm/hbs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.4.0"}]}],"versions":[]}],"fixed_versions":[],"cvss":4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.01131,"percentile":0.66265,"score_date":"2026-10-27"},"published_at":"2021-08-16T18:45:10.000Z","modified_at":"2026-10-27T16:15:05.322069543Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-7f5c-rpf4-86p8","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T16:09:59Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2021-32822","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2024-08-03T23:33:55.940Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-7f5c-rpf4-86p8","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T16:15:05.322069543Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-32822","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32822","source":"GitHub Advisory Database"},{"url":"https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-7f5c-rpf4-86p8","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs/","tags":["x_refsource_CONFIRM","x_transferred"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T16:15:05.322069543Z","content_hash":"dac22b1c27b233b49b00655035aab4295913a6e101f3965c0c5a3d1e58ab0a0b"}}