CVE-2021-32817

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

@adobe/probot-serverless-openwhisk (>=4.0.24 <=4.0.54), @csnext/cs-layer-server (>=0.0.101-beta.22 <=0.0.132-beta.207) +243 more potentially affected by CVE-2021-32822 via hbs (>=1.0.1 <=4.1.2)

hbs NPM version =1.0.1, =4.0.24, =0.0.101-beta.22, =0.7.0, =0.7.0, =0.7.0, =0.19.0, =2.0.1, =0.1.5, =0.9.0, =0.0.1-alpha.0, =0.1.2, =0.1.2, =0.1.0, =0.2.1, =4.3.0 and more Source cves: CVE-2021-32822 Source advisory: OSV:GHSA-7F5C-RPF4-86P8...

GHSA-7F5C-RPF4-86P8 Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

7ghost (>=4.11.0 <=4.11.46), @dobbse/wiki (>=0.12.1-d <=0.12.1-e) +87 more potentially affected by CVE-2021-32817 via express-hbs (>=0.1.6 <=2.4.0)

express-hbs NPM version =0.1.6, =4.11.0, =0.12.1-d, =1.3.1, =3.41.6, =1.0.1, =3.0.7, =4.0.0, =5.1.1, =4.0.4, =1.0.1, =3.40.4-ez-bin.0, =3.41.6-ez-bin.10 - @zce/ghost =2.12.0 and more Source cves: CVE-2021-32817 Source advisory: OSV:GHSA-RWXP-HWWF-653V...