haml Moderate
Code Injection
Discovered about 1 year ago
Published over 4 years ago
Category: Code Injection
Source: GitHub
Severity: Moderate

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > “ ‘ must be escaped properly. In this case, the ‘ character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.

CVSS Metrics
Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
n/a n/a n/a n/a n/a n/a
Patched Versions

>= 5.0.0.beta.2

Unaffected Versions