Information Exposure Affecting express-hbs package, versions <2.4.0
Threat Intelligence
EPSS
0.16% (54th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-EXPRESSHBS-1293211
- published 17 May 2021
- disclosed 17 May 2021
- credit Unknown
Introduced: 17 May 2021
CVE-2021-32817 Open this link in a new tabHow to fix?
Upgrade express-hbs to version 2.4.0 or higher.
Overview
express-hbs is an Express handlebars template engine complete with multiple layouts, partials and blocks.
Affected versions of this package are vulnerable to Information Exposure. The layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extensions (i.e. file.extension) can be included, files that lack an extension will have .hbs appended to them.
References
CVSS Scores
version 3.1