{"id":"EUVD-2021-2003","enisaUuid":"2fef574e-dec5-3115-87d9-64f0a1e0592a","description":"The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.","datePublished":"Aug 16, 2021, 6:45:10 PM","dateUpdated":"Aug 3, 2024, 11:33:55 PM","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs/\n","aliases":"CVE-2021-32822\nGHSA-7f5c-rpf4-86p8\n","assigner":"GitHub_M","epss":1.13,"enisaIdProduct":[{"id":"e7cc1121-18ec-3f8e-a1b7-f02d6ca8304f","product":{"name":"hbs","vendor":{"name":"pillarjs"}},"product_version":"all"}],"enisaIdVendor":[{"id":"3e0cafe0-331b-3833-91fc-61774ac2904e","vendor":{"name":"pillarjs"}}],"enisaIdVulnerability":[{"id":"8406491b-1498-3b27-9374-89efbfd35e12","vulnerability":{"id":"GHSA-7f5c-rpf4-86p8","description":"Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs","datePublished":"Sep 2, 2021, 5:16:46 PM","dateUpdated":"Aug 26, 2021, 5:12:06 PM","baseScore":null,"references":"https://nvd.nist.gov/vuln/detail/CVE-2021-32822\nhttps://github.com/pillarjs/hbs\nhttps://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs\n","enisa_id":"EUVD-2021-2003\n","aliases":"CVE-2021-32822\nGHSA-7f5c-rpf4-86p8\n","epss":0.0,"dataProcessed":"Apr 21, 2026, 4:03:41 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a7384a75-eb4f-3e75-9f18-cf38d617dce1","vulnerability":{"id":"CVE-2021-32822","description":"The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.","datePublished":"Aug 16, 2021, 6:45:10 PM","dateUpdated":"Aug 3, 2024, 11:33:55 PM","status":"PUBLISHED","baseScore":4.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","references":"https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs/\n","enisa_id":"EUVD-2021-2003\n","assigner":"GitHub_M","epss":1.13,"dataProcessed":"Oct 24, 2026, 7:18:36 AM","vulnerabilityProduct":[{"id":"88ec09b4-0a05-32f6-adec-fd3ef8452d40","product":{"name":"hbs","vendor":{"name":"pillarjs"}},"product_version":"all"}],"vulnerabilityVendor":[{"id":"02e85214-54fa-35f3-99a0-497610a62b60","vendor":{"name":"pillarjs"}}]}}],"enisaIdAdvisory":[{"id":"fb349917-aae1-3e5d-a1cc-54988467aba8","advisory":{"id":"WID-SEC-W-2023-2709","description":"IBM QRadar SIEM (Pulse App): Schwachstelle ermöglicht Offenlegung von Informationen","summary":"Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen.","datePublished":"Oct 18, 2023, 10:00:00 PM","dateUpdated":"Oct 18, 2023, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2709.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2023-2709\n","aliases":"CVE-2021-32822\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0cbf6855-2c81-337d-88a8-dd3258ce5bf9","product":{"name":"IBM QRadar SIEM Pulse App \u003c  2.2.11","vendor":{"name":"IBM"}}}]}}]}