CVE-2021-32819

Remote code execution in squirrelly

CVSS 8 HIGHEPSS 59.8%CWE-200

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8EPSS 59.8%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

14 May 2021Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected products

squirrellyjs · squirrelly

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e https://github.com/squirrellyjs/squirrelly/commit/dca7a1e7ee91d8a6ffffb655f3f15647486db9da https://github.com/squirrellyjs/squirrelly/pull/254 https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/