Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE4ajYtcHdxeC1wbTk2

Insecure template handling in Squirrelly

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. Version 9.0.0 has a fix for this issue. For complete details refer to the referenced GHSL-2021-023.

Permalink: https://github.com/advisories/GHSA-q8j6-pwqx-pm96
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE4ajYtcHdxeC1wbTk2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 3 years ago
Updated: about 1 year ago

CVSS Score: 8.0
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Identifiers: GHSA-q8j6-pwqx-pm96, CVE-2021-32819
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-32819
• https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/
• https://github.com/squirrellyjs/squirrelly/pull/254
• https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e
• https://github.com/squirrellyjs/squirrelly/commit/dca7a1e7ee91d8a6ffffb655f3f15647486db9da
• https://github.com/advisories/GHSA-q8j6-pwqx-pm96

Repository: https://github.com/squirrellyjs/squirrelly
Blast Radius: 21.9

Affected Packages