Cross-Site Scripting Vulnerability in hbs Express View Engine by PillarJS

CVE-2026-16231

What is CVE-2026-16231?

The hbs Express view engine, which wraps Handlebars, has a vulnerability in its registerAsyncHelper API that can lead to cross-site scripting (XSS). During the initial render, an async helper returns a placeholder, allowing attacker-controlled content to be injected as raw HTML and JavaScript after rendering. This flaw affects hbs versions 2.1.0 through 4.2.1. Users are strongly advised to upgrade to version 4.3.0 or later, which implements proper HTML escaping for async helper outputs. Applications that need to emit raw HTML should use hbs.SafeString explicitly.

References