MEDIUM6.1

GHSA-r53w-g4xm-3gc6

Haml vulnerable to cross-site scripting

Quick fix

GHSA-r53w-g4xm-3gc6 — haml: upgrade to the fixed version with the command below.

bundle update haml

Details

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like `< > " '` must be escaped properly. In this case, the `'` character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/haml

Introduced in: 0Fixed in: 5.0.0

Fixbundle update haml

References

https://nvd.nist.gov/vuln/detail/CVE-2017-1002201[ADVISORY]
https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2[WEB]
https://github.com/haml/haml[WEB]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/haml/CVE-2017-1002201.yml[WEB]
https://lists.debian.org/debian-lts-announce/2019/11/msg00007.html[WEB]
https://lists.debian.org/debian-lts-announce/2021/12/msg00028.html[WEB]
https://security.gentoo.org/glsa/202007-27[WEB]
https://snyk.io/vuln/SNYK-RUBY-HAML-20362[WEB]