CVE-2021-32819

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS 通过 Express 渲染 API 将纯模板数据与引擎配置选项混合在一起。通过覆盖内部配置选项，可能在下游应用程序中触发远程代码执行。 来源 https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/ 分析 https://blog.diefunction.io/vulnerabilities/ghsl-2021-023 squirrelly v8.0.0 = v8.0.8 远程代码执行 环境 Ubuntu 20.04.1 ...

CVE-2024-40453

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName...

Code Injection

SquirrellyJS is vulnerable to Code Injection. The vulnerability is due to improper handling of input in the options.varName component of SquirrellyJS, allowing an attacker to inject and execute arbitrary code...

squirrelly Code Injection vulnerability

squirrellyjs squirrelly v9.0.0 was discovered to contain a code injection vulnerability via the component options.varName. The issue was fixed in version 9.1.0...

GHSA-W5PW-GMCW-RFC8 squirrelly Code Injection vulnerability

squirrellyjs squirrelly v9.0.0 was discovered to contain a code injection vulnerability via the component options.varName. The issue was fixed in version 9.1.0...

CVE-2024-40453

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName...

CVE-2024-40453

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName...

PT-2024-28852

Name of the Vulnerable Software and Affected Versions squirrellyjs squirrelly version 9.0.0 Description The issue is a code injection vulnerability via the component options.varName. This vulnerability was discovered in squirrellyjs squirrelly and was fixed in version 9.0.1, however, another sour...

CVE-2024-40453

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName...

CVE-2024-40453

CVE-2024-40453 affects squirrellyjs (v9.0.0) with a code injection vulnerability via the component option varName. An exploit exists (POC) demonstrating remote code execution-like behavior; see exploit repo: https://github.com/BwithE/CVE-2024-40453. Remediation per sources: upgrade to v9.0.1 or l...

CVE-2024-40453: Improper Control of Generation of Code

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Squirrelly

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS mixes pure templa...