{"id":"CVE-2021-32822","aliases":["GHSA-7f5c-rpf4-86p8"],"title":"hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor","summary":"hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor","severity":"medium","cvss":4,"cwe":["CWE-94","CWE-200","CWE-538"],"vendor":"hbs","product":"hbs","ecosystem":"npm","affected":["hbs <= 4.4.0"],"published":"2021-09-02","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:09:59Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7f5c-rpf4-86p8","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32822"},{"url":"https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs"},{"url":"https://github.com/advisories/GHSA-7f5c-rpf4-86p8"}],"tags":["ghsa","npm"],"epss":0.01131,"epssPercentile":0.66265,"ingestedAt":"2026-10-27T16:11:58.691Z","slug":"CVE-2021-32822","body":"## Overview\n\nThe npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.\n\n## Affected packages\n\n- `hbs <= 4.4.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":22,"depthScoreParts":{"impact":22,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}