CVE-2026-16231
Received Received - Intake

Stored XSS in hbs Express View Engine via Async Helper

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: openjs

Description
hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitutes the placeholder with the raw callback return value without escaping it, across the cached, uncached, and layout render paths. An application that passes attacker-influenced data, for example user-supplied content from a database, into an async helper callback can therefore have arbitrary HTML and JavaScript injected into the server-rendered page, resulting in stored or reflected cross-site scripting. Versions 2.1.0 through 4.2.1 are affected, and the issue is fixed in 4.3.0, which HTML-escapes async helper output. Applications that intentionally emit raw HTML from an async helper can opt in explicitly with hbs.SafeString. Users should upgrade to 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-16231
EUVD
EUVD-2026-65392

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in the hbs npm package, versions 2.1.0 through 4.2.1. It occurs because the registerAsyncHelper API bypasses Handlebars' automatic HTML escaping. When an async helper returns data, it is inserted as raw HTML into templates without proper escaping, allowing attackers to inject malicious scripts if they control the input data.

Detection Guidance

To detect this vulnerability, check if your application uses hbs versions between 2.1.0 and 4.2.1 and employs the registerAsyncHelper API. Inspect template files for double-brace syntax {{...}} where async helpers process user-controlled data. Use commands like npm list hbs to verify installed versions and grep -r registerAsyncHelper to search for vulnerable code patterns.

Impact Analysis

If your application uses hbs versions 2.1.0 to 4.2.1 and relies on registerAsyncHelper with user-controlled data, attackers could inject arbitrary HTML or JavaScript into server-rendered pages. This may lead to stored or reflected XSS attacks, compromising user sessions, stealing data, or defacing content.

Compliance Impact

This XSS vulnerability could violate GDPR by exposing user data through script injection or HIPAA by compromising protected health information in web applications. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to inadequate security controls for data protection.

Mitigation Strategies

Upgrade the hbs package to version 4.3.0 or later using npm update hbs. If upgrading is not immediately possible, audit all async helper callbacks to ensure they do not process untrusted input. Avoid using registerAsyncHelper with user-controlled data until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart