Vulnerability · Published May 14, 2021 · Assigned by GitHub_M

CVE-2021-32818Remote code execution and Reflected cross site scripting in haml-coffee

High 7.7

In plain English

A high-severity cross-site scripting in haml-coffee from netzpirat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.7%top 46.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	haml-coffee	no fix listed	GHSA-m7mf-vm62-7x3q

Affected products (as reported)

Vendor	Product	Versions
netzpirat	haml-coffee	<= 1.14.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://securitylab.github.com/advisories/GHSL-2021-025-haml-coffee/ x_refsource_CONFIRM
https://www.npmjs.com/package/haml-coffee x_refsource_MISC