CVE-2026-16231

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitutes the placeholder with the raw callback return value without escaping it, across the cached, uncached, and layout render paths. An application that passes attacker-influenced data, for example user-supplied content from a database, into an async helper callback can therefore have arbitrary HTML and JavaScript injected into the server-rendered page, resulting in stored or reflected cross-site scripting. Versions 2.1.0 through 4.2.1 are affected, and the issue is fixed in 4.3.0, which HTML-escapes async helper output. Applications that intentionally emit raw HTML from an async helper can opt in explicitly with hbs.SafeString. Users should upgrade to 4.3.0.

• CWE-79

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/pillarjs/hbs/security/advisories/GHSA-rg36-rxv9-2m9qVendor Advisory

Published

Aug 25, 2026

Last Modified

Aug 31, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16226A weakness has been identified in SourceCodester Pizzafy Eco…5.1
• CVE-2026-16227A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-16228A vulnerability was detected in SourceCodester Class and Exa…7.3
• CVE-2026-16229A flaw has been found in itsourcecode Courier Management Sys…4.3
• CVE-2026-1623A weakness has been identified in Totolink A7000R 4.1cu.4154…6.3
• CVE-2026-16230The Formidable Digital Signatures plugin for WordPress is vu…9.8
• CVE-2026-16232An authentication bypass vulnerability in the Check Point Sm…9.8
• CVE-2026-16233There is a memory corruption vulnerability recently discover…7.8
• CVE-2026-16234There is a memory corruption vulnerability recently discover…7.8
• CVE-2026-16235Crypt::Password versions through 0.28 for Perl generate inse…9.8
• CVE-2026-16236The Realtyna Organic IDX plugin for WordPress is vulnerable …8.8
• CVE-2026-16238Type confusion in PostgreSQL pg_restore_attribute_stats() al…8.8