Insecure template handling in haml-coffee

Description

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.14.1

References

• GHSA-m7mf-vm62-7x3q
• www.npmjs.com
• CVE-2021-32818
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Angular vulnerable to Cross-site Scripting - CVE-2020-7676
• rollbar vulnerable to prototype pollution - CVE-2025-57325
• csvjson vulnerable to prototype injection - CVE-2025-57318
• Prebid.js NPM package briefly compromised - CVE-2025-59038

Tags:

npm

haml-coffee