{"id":"EUVD-2021-2003","revision":"ece8e779e4774e7d9af76642e26b2efb","records":[{"revision":"ece8e779e4774e7d9af76642e26b2efb","observedAt":"2026-10-28T15:51:58.413+00:00","statement":{"source":"euvd","id":"EUVD-2021-2003","aliases":["CVE-2021-32822","GHSA-7f5c-rpf4-86p8"],"title":"The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data wi…","description":"The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","score":4,"severity":null}],"references":["https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs/"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2003","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 16, 2021, 6:45:10 PM","dateUpdated":"Aug 3, 2024, 11:33:55 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2023-2709","title":"IBM QRadar SIEM (Pulse App): Schwachstelle ermöglicht Offenlegung von Informationen","vulnerabilityIds":["CVE-2021-32822"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2021-2003","identifiers":["EUVD-2021-2003","CVE-2021-32822","GHSA-7f5c-rpf4-86p8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}