CVE-2021-32822 – hbs

Package

Manager: npm
Name: hbs
Vulnerable Version: >=0 <=4.2.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

EPSS: 0.00299 pctl0.5273

Details

Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.

Metadata

Created: 2021-09-02T17:16:46Z
Modified: 2021-08-26T17:12:06Z
Source: MANUAL
CWE IDs: ["CWE-200", "CWE-538", "CWE-94"]
Alternative ID: GHSA-7f5c-rpf4-86p8
Finding: F422
Auto approve: 1