Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Express Template Engine Mixes User Data with Configuration Options

CVE-2021-32818 · published 5 years ago
Summary

If an application using the haml-coffee template engine passes user-controlled data to templates, it may be possible for attackers to inject malicious code. This could lead to security issues like cross-site scripting attacks. For now, there is no fix available for this issue, so affected applications should be updated to a secure version of the template engine.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
npm netzpirat haml-coffee <= 1.14.1
– haml-coffee_project haml-coffee <= 1.14.1
cpe:2.3:a:haml-coffee_project:haml-coffee:*:*:*:*:*:node.js:*:*
Original advisory text
haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overr...
haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published14 May 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-m7mf-vm62-7x3q · GHSA
CVE-2021-32818 · NVD
Track software like this
Free during beta