---
id: CVE-2021-32822
aliases:
  - GHSA-7f5c-rpf4-86p8
title: >-
  hbs: Insertion of Sensitive Information into Externally-Accessible File or
  Directory and Exposure of Sensitive Information to an Unauthorized Actor
summary: >-
  hbs: Insertion of Sensitive Information into Externally-Accessible File or
  Directory and Exposure of Sensitive Information to an Unauthorized Actor
severity: medium
cvss: 4
cwe:
  - CWE-94
  - CWE-200
  - CWE-538
vendor: hbs
product: hbs
ecosystem: npm
affected:
  - hbs <= 4.4.0
published: '2021-09-02'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T16:09:59Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-7f5c-rpf4-86p8'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-32822'
  - url: 'https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs'
  - url: 'https://github.com/advisories/GHSA-7f5c-rpf4-86p8'
tags:
  - ghsa
  - npm
epss: 0.01131
epssPercentile: 0.66265
ingestedAt: '2026-10-27T16:11:58.691Z'
---

## Overview

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.

## Affected packages

- `hbs <= 4.4.0`

## Remediation

Refer to the advisory for the patched release.