CVE-2021-32819CWE-200

Remote code execution in squirrelly

High · published May 14, 2021

Patch now

High probability of exploitation

CVSS calls it high at 8.0. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1

8.0

EPSS

58%

Percentile

99.1

In the wild

Unconfirmed

What it is

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.

The record

Technical detail

CVSS v3.1: 8.0 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.58286 · 99.1th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2021-05-14T00:00Z

EPSS history

Timeline

14 MAY 00:00Z
Remote code execution in squirrelly
cvelistv5