File disclosure in Express Handlebars
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-94.
Summary
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| express-handlebars | express-handlebars | up to 5.3.2 | — | No fix listed | CNA |
| — | express-handlebars (npm) | before 5.3.1 | 5.3.1 | Patch available | GHSA-fr76-2wp8-fp92 |
- express-handlebars Vendorexpress-handlebars Affected up to 5.3.2 Fixed in — No fix listed CNA
- express-handlebars (npm) Vendor— Affected before 5.3.1 Fixed in 5.3.1 Patch available GHSA-fr76-2wp8-fp92
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:express_handlebars_project:express_handlebars:*:*:*:*:*:node.js:*:* | up to 5.3.2 | Vulnerable | Express Handlebars Project |
- cpe:2.3:a:express_handlebars_project:express_handlebars:*:*:*:*:*:node.js:*:* Versions up to 5.3.2 Vulnerable ·Express Handlebars Project
Remediation
- Fix · GHSA-fr76-2wp8-fp92 express-handlebars (npm) Fixed in 5.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32820
- 2026-10-03 Alias added: GHSA-fr76-2wp8-fp92
References
Exploit 2
Advisory 4
More Express Handlebars Project Express Handlebars vulnerabilities
- TI-2021-12482 File disclosure in express-hbs CVSS 3.1MEDIUM 6.8
Sources
- CVE-2021-32820 · CVE Program
- CVE-2021-32820 · NVD
- FIRST EPSS
- GHSA-fr76-2wp8-fp92 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences