Log in Start free

Vulnerability · Published May 14, 2021 · Assigned by GitHub_M

CVE-2021-32820File disclosure in Express Handlebars

High 8.6

In plain English

A high-severity information exposure in express-handlebars from express-handlebars. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.7% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.6High
Exploit odds (30 days)15.7%top 3.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei

Official description

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmexpress-handlebars5.3.1GHSA-fr76-2wp8-fp92

Affected products (as reported)

VendorProductVersions
express-handlebars express-handlebars <= 5.3.2

Weakness: CWE-200

References