Description
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pillarjs | hbs | all | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | hbs | <= 4.4.0 | — | GHSA-7f5c-rpf4-86p8 |
Advisories 1
- WID-SEC-2023-2709 IBM QRadar SIEM (Pulse App): Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 18, 2023