Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

CVE-2024-40453

CVE-2024-40453 - Squirrelly v9.0.0 RCE Disclaimer: This script is for educational use only. Do not use it for illegal purposes. If you do, it’s entirely your responsibility; I am not liable for any misuse. Description This script creates a reverse shell called payload.sh in the current directory...

Exploit for Code Injection in Squirrelly

CVE-2024-40453 - Squirrelly v9.0.0 RCE Disclaimer: This sc...

CVE-2021-32819

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

@miragon/miranum-cli (>=0.5.5, <=0.5.12) potentially affected by CVE-2024-40453 via squirrelly (9.0.0)

squirrelly NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on squirrelly and may be impacted: - @miragon/miranum-cli =0.5.5, =0.5.12 Source cves: CVE-2024-40453 Source advisory: GHSA-W5PW-GMCW-RFC8...

@miragon/miranum-cli (>=0.5.5, <=0.5.12) potentially affected by CVE-2024-40453 via squirrelly (9.0.0)

squirrelly NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on squirrelly and may be impacted: - @miragon/miranum-cli =0.5.5, =0.5.12 Source cves: CVE-2024-40453 Source advisory: OSV:GHSA-W5PW-GMCW-RFC8...

Squirrelly security vulnerabilities

Squirrelly is a modern, configurable, and ultra-fast template engine implemented in JavaScript by Squirrelly Open Source. A security vulnerability exists in Squirrelly version v9.0.0, which stems from the discovery of a contained code injection vulnerability via the component options.varName...

CVE-2024-40453

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName...

CVE-2024-40453

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName...

@miragon/miranum-cli (>=0.5.5, <=0.5.12) potentially affected by CVE-2024-40453 via squirrelly (9.0.0)

squirrelly NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on squirrelly and may be impacted: - @miragon/miranum-cli =0.5.5, =0.5.12 Source cves: CVE-2024-40453 Source advisory: MEND:CVE-2024-40453...

VulnCheck KEV: CVE-2021-32819

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

@adradr/hardhat-dodoc (0.3.0), @azure-tools/adl-rpaas-controller (>=0.1.0, <=0.1.1) +47 more potentially affected by CVE-2021-32819 via squirrelly (8.0.8)

squirrelly NPM version 8.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on squirrelly and may be impacted: - @adradr/hardhat-dodoc 0.3.0 - @azure-tools/adl-rpaas-controller =0.1.0, =0.1.1, =0.3.0, =0.0.5, =1.0.1, =1.0.1, =0.1.0, =0.1.0-beta.1642,...

GHSA-Q8J6-PWQX-PM96 Insecure template handling in Squirrelly

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

Insecure template handling in Squirrelly

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

CVE-2021-32819

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

CVE-2021-32819

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

Remote code execution

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

CVE-2021-32819

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

CVE-2021-32819: Exposure of Sensitive Information to an Unauthorized Actor

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

CVE-2021-32819

The Squirrelly JavaScript template engine is vulnerable to Remote Code Execution (RCE) because it mixes pure template data with engine configuration options via the Express render API. An attacker can overwrite internal configuration options to trigger RCE in downstream applications. This vulnera...