XSS in Haml-Coffee Project
CVE-2021-32818
haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.007 (50.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Haml-coffee_project Haml-coffee
- Netzpirat Haml-coffee — versions <= 1.14.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Product, Exploit, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-32818?
- CVE-2021-32818 is a high-severity vulnerability in Haml-Coffee Project, classified under Cross-site Scripting. CVSS score: 7.7/10. Published 2021-05-14.
- How severe is CVE-2021-32818?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2021-32818 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.