Insecure template handling in haml-coffee

Description

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.14.1

References

• GHSA-m7mf-vm62-7x3q
• www.npmjs.com
• CVE-2021-32818
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Insecure template handling in Squirrelly - CVE-2021-32819
• Insecure password handling vulnerability in Strapi - CVE-2021-46440
• Insecure random number generation in keypair - CVE-2021-41117
• GraphiQL introspection schema template injection attack - CVE-2021-41248

Tags:

npm

haml-coffee