CVE-2021-32819

    Dashboard / Vulnerabilities / CVE-2021-32819

    CVE-2021-32819

    Published: 14 May 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.

    References: https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e, https://github.com/squirrellyjs/squirrelly/commit/dca7a1e7ee91d8a6ffffb655f3f15647486db9da, https://github.com/squirrellyjs/squirrelly/pull/254, https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4bb3596c4f7e760a379f29c410eed64689762ee1
    Fixed -None

    Affected versions

    8.0.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32819 | CVE-DB