CVE-2021-32822Medium· 4.0▾ Sunlithbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
1.1%
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
hbs <= 4.4.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-16231High· 8.1hbs is an Express view engine that wraps Handlebars
CVE-2026-87123Medium· 5.9hbs is an Express view engine wrapper for Handlebars
CVE-2025-11079Medium· 5.3A security flaw has been discovered in Campcodes Farm Management System 1.0
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2024-39896High· 7.5Directus Allows Single Sign-On User Enumeration
CVE-2024-0340Medium· 4.4Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()