The hbs view engine’s registerAsyncHelper API bypasses Handlebars’ automatic HTML escaping. When an async helper returns a placeholder during the first render pass, Handlebars escapes the placeholder but later replaces it with the raw return value without escaping, allowing attacker‑supplied data to inject arbitrary HTML or JavaScript. This is a classic input validation flaw (CWE‑79) that can lead to stored or reflected cross‑site scripting, compromising confidentiality, integrity, and availability of the web application.

Versioned releases of the hbs Express view engine from 2.1.0 through 4.2.1 are affected. The issue is fixed in 4.3.0, which properly HTML‑escapes async helper output. Applications that deliberately need to render raw HTML in an async helper should use hbs.SafeString to opt‑in.

With a CVSS score of 8.1, the vulnerability poses a high risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker–controlled input that is passed to an async helper callback, either directly or via a database. Based on the description, it is inferred that the attacker must supply data that reaches the async helper; once executed, the placeholder substitution mechanism injects unsanitized content into the rendered page, enabling session hijacking, defacement, or further attacks. Given that the flaw exists in all rendering paths and that no special privileges or network access are required beyond influencing data, exploitation is highly feasible in vulnerable installations.