hbs@3.1.1

Express.js template engine plugin for Handlebars

latest version

4.3.1

first published

15 years ago

latest version published

5 days ago

licenses detected

MIT
>=0

View hbs package health on Snyk (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the hbs package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Cross-site Scripting (XSS) hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `replaceAsyncValues` render path in `lib/hbs.js`. An attacker can inject script into rendered HTML by supplying attacker-controlled data to a `registerAsyncHelper` callback that is rendered with `{{...}}`, causing the helper’s return value to be inserted into the template output without HTML escaping. When the application serves that rendered page to a browser, the payload executes in the victim’s session and can steal data or perform actions as that user. The issue affects both cached and uncached rendering flows, as well as layouts that include the async helper output. How to fix Cross-site Scripting (XSS)? Upgrade `hbs` to version 4.3.0 or higher.	>=2.1.0 <4.3.0
L Information Exposure hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Information Exposure. `hbs` mixes pure template data with engine configuration options through the `Express` render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. How to fix Information Exposure? There is no fixed version for `hbs`.	*

Cross-site Scripting (XSS)

hbs is an Express.js template engine plugin for Handlebars

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the replaceAsyncValues render path in lib/hbs.js. An attacker can inject script into rendered HTML by supplying attacker-controlled data to a registerAsyncHelper callback that is rendered with {{...}}, causing the helper’s return value to be inserted into the template output without HTML escaping. When the application serves that rendered page to a browser, the payload executes in the victim’s session and can steal data or perform actions as that user. The issue affects both cached and uncached rendering flows, as well as layouts that include the async helper output.

How to fix Cross-site Scripting (XSS)?

Upgrade hbs to version 4.3.0 or higher.

>=2.1.0 <4.3.0

Information Exposure

hbs is an Express.js template engine plugin for Handlebars

Affected versions of this package are vulnerable to Information Exposure. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications.

How to fix Information Exposure?

There is no fixed version for hbs.

Go back to all versions of this package