{"cve":"CVE-2021-32818","nvd":{"published":"2021-05-14T19:15:07.880","modified":"2026-06-17T03:53:41.673","status":"Modified","description":"haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-79"],"references":["https://securitylab.github.com/advisories/GHSL-2021-025-haml-coffee/","https://www.npmjs.com/package/haml-coffee","https://securitylab.github.com/advisories/GHSL-2021-025-haml-coffee/","https://www.npmjs.com/package/haml-coffee"],"products":["haml-coffee_project:haml-coffee"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2021-32818","score":0.007,"percentile":0.53177,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-m7mf-vm62-7x3q","url":"https://osv.dev/vulnerability/GHSA-m7mf-vm62-7x3q","summary":"Insecure template handling in haml-coffee","modified":"2023-11-08T04:06:01.136618Z","packages":[{"ecosystem":"npm","name":"haml-coffee","purl":"pkg:npm/haml-coffee","ranges":["<=1.14.1"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}