Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-16231
By Ido Mizrahi |
25 August 2026
hbs registerAsyncHelper escaping bypass enables XSS in server-rendered Handlebars templates
hbs async helper output escapes a placeholder then substitutes raw callback output, bypassing Handlebars auto-escaping across cached/uncached/layout renders. Affects hbs `>=2.1.0,