Description
Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. Version 9.0.
Recommendation
Update the squirrelly package to the latest compatible version. Followings are version details:
- Affected version(s): <= 8.0.8
- Patched version(s): 9.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Insecure template handling in Squirrelly and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Insecure template handling in haml-coffee - CVE-2021-32818
- Insecure password handling vulnerability in Strapi - CVE-2021-46440
- GraphiQL introspection schema template injection attack - CVE-2021-41248
- uri-template-lite Regular Expression Denial of Service - CVE-2021-43309
You might also like:
See something that needs correcting? Let us knowUpdated September 11, 2023