CVE-2021-32819

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
squirrellyjssquirrelly>= 9.0.0, < 9.0.0

References

Timeline

Published
May 14, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-32827.5HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without autheCVE-2021-328208.6Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options thCVE-2021-328217.5MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulneraCVE-2021-328225.3The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosurCVE-2021-328233.7In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for CVE-2021-328249.8Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code executioCVE-2021-328259.1bblfshd is an open source self-hosted server for source code parsing. In bblfshd before commit 4265465b9b6fb5663c30ee43806126012066aad4 therCVE-2021-328268.1Proxyee-Down is open source proxy software. An attacker being able to provide an extension script (eg: through a MiTM attack or by hosting aCVE-2021-328279.6MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trickCVE-2021-328286.1The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST CVE-2021-328299.9ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, andCVE-2021-32837.5HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same no