{"cve":"CVE-2021-32819","nvd":{"published":"2021-05-14T19:15:07.920","modified":"2026-06-17T03:53:41.787","status":"Modified","description":"Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-200"],"references":["https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e","https://github.com/squirrellyjs/squirrelly/commit/dca7a1e7ee91d8a6ffffb655f3f15647486db9da","https://github.com/squirrellyjs/squirrelly/pull/254","https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/","https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e"],"products":["squirrelly:squirrelly"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2021-32819","score":0.58286,"percentile":0.99095,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q8j6-pwqx-pm96","url":"https://osv.dev/vulnerability/GHSA-q8j6-pwqx-pm96","summary":"Insecure template handling in Squirrelly","modified":"2023-11-08T04:06:01.196942Z","packages":[{"ecosystem":"npm","name":"squirrelly","purl":"pkg:npm/squirrelly","ranges":["<9.0.0"],"fixed":["9.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}