All vulnerabilities
CVE-2021-32822GHSA-7f5c-rpf4-86p8

hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor

pillarjs hbsnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.13%Chance of exploitation activity in the next 30 days, higher than 66% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published16 Aug 2021Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.

Text from CVE List

Affected versions 3

  • hbs, npm<= 4.4.0GitHub
  • hbsaffected: allCVE List
  • hbs, npmfrom first release, through 4.4.0OSV

References 4