Hbs
Monthly
HTML escaping in the hbs Express/Handlebars view engine (versions 2.1.0-4.2.1) is bypassed by the registerAsyncHelper API, enabling stored or reflected cross-site scripting in any Express application that passes attacker-influenced data through an async helper callback. The two-pass rendering pipeline escapes only an opaque placeholder in the first pass, then silently substitutes the raw, unescaped callback return value, affecting cached, uncached, and layout render paths equally. No active exploitation has been confirmed in CISA KEV; the issue is fixed in hbs 4.3.0.
The npm hbs package is an Express view engine wrapper for Handlebars. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
HTML escaping in the hbs Express/Handlebars view engine (versions 2.1.0-4.2.1) is bypassed by the registerAsyncHelper API, enabling stored or reflected cross-site scripting in any Express application that passes attacker-influenced data through an async helper callback. The two-pass rendering pipeline escapes only an opaque placeholder in the first pass, then silently substitutes the raw, unescaped callback return value, affecting cached, uncached, and layout render paths equally. No active exploitation has been confirmed in CISA KEV; the issue is fixed in hbs 4.3.0.
The npm hbs package is an Express view engine wrapper for Handlebars. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.