Skip to content
OpenAdvisories

Vendor

hbs

2 known vulnerabilities.

Products

hbs 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-16231

    hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

    hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placehol…

    hbs hbs