cve.bz

CVE-2021-32819

8.8 highEPSS 58%

High (8.8) in squirrelly squirrelly. EPSS 58% chance of exploitation in the next 30 days. Fixed in squirrelly 9.0.0.

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.

Severity

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
58% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-200
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-q8j6-pwqx-pm96npmsquirrelly<9.0.09.0.0

References

Check your stackJSON