{"id":"CVE-2021-32822","kind":"vulnerability","aliases":["CVE-2021-32822","GHSA-7f5c-rpf4-86p8"],"related":[],"title":"hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor","description":"The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.","summary":"The npm hbs package, an Express view engine for Handlebars, mixes template data with engine configuration passed through the Express render API. An attacker who controls data passed to render can overwrite internal options and trigger reading of arbitrary files from the server.","severity":"medium","cvss":5.3,"epss":0.01131,"exploited":false,"exploited_at":null,"products":[{"name":"hbs","fixed":[],"affected":"<= 4.4.0","ecosystem":"npm"},{"name":"hbs project hbs","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-200","cwe-538","cwe-94","express","handlebars","hbs","node","package","self-hosted"],"not_affected_if":["fixed-template-data","no-hbs"],"how_to_check":"- Run `npm ls hbs` in the project to see whether hbs is installed and which version resolves.\n- Search application code for calls to `res.render` or `app.render` that pass user-controlled objects straight into template data.","fix":null,"status":"open","published_at":"2021-08-16T19:15:14+00:00","first_seen_at":"2026-10-27T16:10:07+00:00","triaged_at":"2026-10-27T16:10:58+00:00","updated_at":"2026-10-27T16:33:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:10:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"hbs: template data can override engine options and disclose files","impact":"medium","summary":"The npm hbs package, an Express view engine for Handlebars, mixes template data with engine configuration passed through the Express render API. An attacker who controls data passed to render can overwrite internal options and trigger reading of arbitrary files from the server.","category":"package","nicknames":[],"who_cares":["express","node","hbs","handlebars","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"server files readable by an attacker through a template render","analyst_note":"Sources state no patch exists; check GHSA-7f5c-rpf4-86p8 and GHSL-2021-020 for a fixed version or mitigation and confirm the affected range.","how_to_check":"- Run `npm ls hbs` in the project to see whether hbs is installed and which version resolves.\n- Search application code for calls to `res.render` or `app.render` that pass user-controlled objects straight into template data.","needs_analyst":true,"not_affected_if":["no-hbs","fixed-template-data"],"who_is_affected":"Express applications that use hbs as their view engine and pass request-derived or otherwise untrusted objects into render calls are exposed. Applications that render only fixed data, or do not use hbs, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000594,"input_tokens":3450,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-020':166C '-200':38B '-2021':23A,31A,165C '-32822':24A,32A '-538':40B '-94':42B '7f5c':27A '86p8':29A 'access':9A 'actor':21A 'api':72B,141C 'applic':156C 'arbitrari':89B 'attack':74B 'configur':66B,135C,145C 'control':76B 'current':122C 'cve':22A,30A 'cwe':37B,39B,41B 'data':63B,77B,132C 'depend':106C 'directori':12A 'disclosur':118C,149C 'downstream':155C 'engin':58B,65B,102C,134C 'exampl':159C 'exposur':14A 'express':43B,56B,70B,100C,139C 'extern':8A 'externally-access':7A 'file':10A,90B,117C,148C 'ghsa':26A 'ghsa-7f5c-rpf4-86p8':25A 'ghsl':164C 'handlebar':44B,60B,105C 'hbs':1A,33A,34A,36A,45B,53B,96C,111C,128C 'host':50B 'inform':5A,17A 'insert':2A 'intern':83B,144C 'may':112C,151C 'mix':61B,129C 'node':46B 'npm':52B,95C 'option':84B,136C,146C 'overwrit':82B,143C 'packag':47B,54B,97C 'pass':67B,78B 'patch':124C 'poc':160C 'project':35A 'pure':130C 'read':87B 'referenc':163C 'render':71B,80B,140C 'rpf4':28A 'see':161C 'self':49B 'self-host':48B 'sensit':4A,16A 'server':93B 'templat':62B,131C 'trigger':86B,153C 'unauthor':20A 'usag':108C 'user':109C 'view':57B,101C 'vulner':114C,119C,127C,150C 'wrapper':103C","nicknames":[],"mitigations":[],"who_affected":"Express applications that use hbs as their view engine and pass request-derived or otherwise untrusted objects into render calls are exposed. Applications that render only fixed data, or do not use hbs, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2021-08-16T19:15:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7f5c-rpf4-86p8","url":"https://github.com/advisories/GHSA-7f5c-rpf4-86p8","severity":"medium","published_at":"2021-09-02T17:16:46+00:00","modified_at":"2026-10-27T16:09:59+00:00","first_seen_at":"2026-10-27T16:10:07+00:00","fetched_at":"2026-10-27T16:15:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-32822","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32822","severity":null,"published_at":"2021-08-16T19:15:14+00:00","modified_at":"2026-06-17T03:53:42+00:00","first_seen_at":"2026-10-27T16:33:08+00:00","fetched_at":"2026-10-27T16:33:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}