Live › vulnerability › CVE-2021-32822
Go to dashboardThe npm hbs package, an Express view engine for Handlebars, mixes template data with engine configuration passed through the Express render API. An attacker who controls data passed to render can overwrite internal options and trigger reading of arbitrary files from the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:10 UTC, 0h before NVD. All times on this page are UTC.
Express applications that use hbs as their view engine and pass request-derived or otherwise untrusted objects into render calls are exposed. Applications that render only fixed data, or do not use hbs, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| hbs | npm | <= 4.4.0 | – |
| hbs project hbs | vendor | – | – |
npm ls hbs in the project to see whether hbs is installed and which version resolves.res.render or app.render that pass user-controlled objects straight into template data.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
This page as .md · .json · in your agent: get_signal("CVE-2021-32822")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.