hbs CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH hbs CVE published 2026-08-25

CVE-2026-16231

The hbs Express view engine, which wraps Handlebars, has a vulnerability in its registerAsyncHelper API. This API bypasses Handlebars' automatic HTML escaping, allowing an async helper to return an opaque placeholder during the first render pass. The placeholder is only escaped in the double-brace expression, and after rendering, hbs substitutes the placeholder with the raw callback return value without e [truncated]