CVE-2021-32822: File disclosure in hbs

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-16 · updated 2026-06-17
Weakness: CWE-538

Description

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.

Affected products

hbs: all versions

References

https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs/
https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs/

Get alerted when CVE-2021-32822 or the next vulnerability affects your stack