high severity vulnerrability

[jianyexi]

Describe the bug
there is high severity vulnerability in latest npm package,
see GHSA-q8j6-pwqx-pm96
To Reproduce
Steps to reproduce the behavior:
npm audit

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Package & Environment Details

• Environment: ex. Node, Chrome, Firefox, etc. and what version
• Version: ex. 8.1.0

Additional context
Add any other context about the problem here.

[sw360cab]

+1

[dynamikus]

+1

[littlejak20]

If I use Squirrelly on the client side, i.e. directly integrate the JS file.
Is there a vulnerability there too?
Or does this only affect the server-side application, in this case node-express?

I don't see any warnings on the following urls:
https://www.npmjs.com/package/squirrelly
https://github.com/squirrellyjs/squirrelly

In addition, the package is still online

The "Squirrelly.min.js" JS Script is integrated directly in the browser. I invited the JS file directly via Github.
https://github.com/squirrellyjs/squirrelly/arfs/tagen/v8.0.8.zip

I am concerned with whether the security gap exists here too.

[sw360cab]

@littlejak20 you won't find it there.

But if you install it you get an idea here
https://snyk.io/advisor/npm-package/squirrelly

The point is that the library as not a current mainteiner. I am planning to give a look I can give a minum fresh update to id and share here, but I will not assure anything to anybody.

[ImLunaHey]

squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications.

Looking through the code I can't find anywhere this is true, data and options/env are never mixed.

Anyone got any further info on this?

[ImLunaHey]

@agustingianni got any other info on this? Trying the exact code you have in the write up isn't producing anything in the console.

[nebrelbug]

This has been resolved in Squirrelly 9.0.0