Executive brief
hbs is a templating engine for Express that renders Handlebars templates on the server. A vulnerability in its async helper feature bypasses automatic HTML escaping, allowing attackers to inject malicious JavaScript into rendered pages if user-supplied data is processed through async helpers. This can result in stored or reflected cross-site scripting attacks affecting users viewing the compromised pages.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the registerAsyncHelper API. During template rendering, async helpers return opaque placeholders that get double-brace-escaped, but after rendering completes, hbs substitutes these placeholders with raw callback return values without escaping. This escaping bypass affects all render paths including cached, uncached, and layout rendering. Exploitation requires an application to register an async helper, pass attacker-controlled data through it, render the output with {{helperName}} syntax, and serve the result to a victim. The vulnerability is fixed in hbs 4.3.0, which now HTML-escapes async helper output by default; applications needing raw HTML can explicitly wrap output in handlebars.SafeString().
Affected products
- pillarjs hbs 2.1.0 through 4.2.1
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in version 4.3.0