CVE-2021-32819
High
Description
Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.
SeverityHigh
CVSS8.0
Exploit probability—
ProductSquirrelly
PublishedMay 14, 2021
First seenMay 14, 2021
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- squirrelly9.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| squirrelly squirrelly | 8.0.8 | — |
| squirrellynpm | v < 9.0.0 | 9.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.