Haml vulnerable to cross-site scripting

Also known as GHSA-r53w-g4xm-3gc6

Published 7 y ago 2019-10-15 · modified 59 d ago 2026-09-10 · JSON

CVSS

6.1

v3.1 · NVD

CISA KEV

not known exploited

EPSS

1.5%

percentile 74%

Public exploits

none known

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.

Exploit prediction (EPSS)

1.45% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
rubygems	`haml`	<5.0.0	5.0.0

Affected products

http://haml.info/ haml

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2 · x_refsource_MISC, x_transferred
snyk.io /vuln/SNYK-RUBY-HAML-20362 · x_refsource_CONFIRM, x_transferred
lists.debian.org /debian-lts-announce/2019/11/msg00007.html · mailing-list, x_refsource_MLIST, x_transferred
security.gentoo.org /glsa/202007-27 · vendor-advisory, x_refsource_GENTOO, x_transferred
lists.debian.org /debian-lts-announce/2021/12/msg00028.html · mailing-list, x_refsource_MLIST, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-1002201 · advisory
github.com /haml/haml · web
github.com /rubysec/ruby-advisory-db/blob/master/gems/haml/CVE-2017-1002201.yml · web

Sources

CVE List: CVE-2017-1002201
GitHub Advisory: GHSA-r53w-g4xm-3gc6
NVD: CVE-2017-1002201

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary