GHSA-m7mf-vm62-7x3q

    Dashboard / Vulnerabilities / GHSA-m7mf-vm62-7x3q

    GHSA-m7mf-vm62-7x3q

    Published: 17 May 2021Last Modified: 8 Nov 2023

    Summary: Insecure template handling in haml-coffee

    Details: haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-32818, https://securitylab.github.com/advisories/GHSL-2021-025-haml-coffee, https://www.npmjs.com/package/haml-coffee

    Affected packages

    Package

    Name: haml-coffee

    Purl: pkg:npm/haml-coffee

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-m7mf-vm62-7x3q | CVE-DB