CyberRota Analysis
AI-GeneratedThe vulnerability affects the hbs view engine for Express, specifically its registerAsyncHelper API, which improperly handles HTML escaping, allowing for potential cross-site scripting (XSS) attacks through user-supplied content. This can lead to the injection of arbitrary HTML and JavaScript into server-rendered pages, impacting applications that utilize affected versions from 2.1.0 to 4.2.1. Developers and organizations using these versions should prioritize upgrading to 4.3.0 to mitigate the risk of XSS vulnerabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitutes the placeholder with the raw callback return value without escaping it, across the cached, uncached, and layout render paths. An application that passes attacker-influenced data, for example user-supplied content from a database, into an async helper callback can therefore have arbitrary HTML and JavaScript injected into the server-rendered page, resulting in stored or reflected cross-site scripting. Versions 2.1.0 through 4.2.1 are affected, and the issue is fixed in 4.3.0, which HTML-escapes async helper output. Applications that intentionally emit raw HTML from an async helper can opt in explicitly with hbs.SafeString. Users should upgrade to 4.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)