EUVD-2026-65392Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-delivered XSS with no auth needed to inject, victim page-load required (UI:R), session-scoped impact only (S:U), no availability impact.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
3DescriptionCVE.org
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitutes the placeholder with the raw callback return value without escaping it, across the cached, uncached, and layout render paths. An application that passes attacker-influenced data, for example user-supplied content from a database, into an async helper callback can therefore have arbitrary HTML and JavaScript injected into the server-rendered page, resulting in stored or reflected cross-site scripting. Versions 2.1.0 through 4.2.1 are affected, and the issue is fixed in 4.3.0, which HTML-escapes async helper output. Applications that intentionally emit raw HTML from an async helper can opt in explicitly with hbs.SafeString. Users should upgrade to 4.3.0.
AnalysisAI
HTML escaping in the hbs Express/Handlebars view engine (versions 2.1.0-4.2.1) is bypassed by the registerAsyncHelper API, enabling stored or reflected cross-site scripting in any Express application that passes attacker-influenced data through an async helper callback. The two-pass rendering pipeline escapes only an opaque placeholder in the first pass, then silently substitutes the raw, unescaped callback return value, affecting cached, uncached, and layout render paths equally. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Express application calls hbs.registerAsyncHelper and that the async callback returns attacker-influenced data - such as user-submitted content retrieved from a database, request parameters, or any external input - without separately HTML-escaping it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N and score of 8.1 accurately reflect a network-exploitable stored XSS with no authentication prerequisite and high impact on confidentiality (session theft) and integrity (arbitrary DOM manipulation), bounded by requiring a victim to load the affected page (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade hbs to version 4.3.0, which HTML-escapes async helper output by default, closing the bypass at its root. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your organization's software inventory to identify all Express applications using hbs versions 2.1.0-4.2.1, particularly any that implement custom async helpers or process user-supplied template data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today