CVE-2021-32818 json
Remote code execution and Reflected cross site scripting in haml-coffee
published 2021-05-14 5 y ago modified 2026-06-17 4 mo ago also GHSA-m7mf-vm62-7x3q , EUVD-2021-1137
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- npmjs.com https://www.npmjs.com/package/haml-coffee referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | haml-coffee | <=1.14.1 |
no fix listed |
Affected products
- netzpirat haml-coffee
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
npmjs.com
/package/haml-coffee
web, exploit, product
-
securitylab.github.com
/advisories/GHSL-2021-025-haml-coffee/
third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-32818
advisory
-
securitylab.github.com
/advisories/GHSL-2021-025-haml-coffee
advisory
Sources
- CVE List CVE-2021-32818
- GitHub Advisory GHSA-m7mf-vm62-7x3q
- NVD CVE-2021-32818
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.