diff --git a/gems/haml/CVE-2017-1002201.yml b/gems/haml/CVE-2017-1002201.yml
new file mode 100644
index 0000000000..1842fdd4dc
--- /dev/null
+++ b/gems/haml/CVE-2017-1002201.yml
@@ -0,0 +1,19 @@
+---
+gem: haml
+cve: 2017-1002201
+url: https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2
+title: haml failure to escape single quotes
+date: 2017-05-08
+description: |
+  In haml versions prior to version 5.0.0.beta.2, when using user input to
+  perform tasks on the server, characters like < > " ' must be escaped properly.
+  In this case, the ' character was missed. An attacker can manipulate the input
+  to introduce additional attributes, potentially executing code.
+cvss_v2: 4.3
+cvss_v3: 6.1
+patched_versions:
+  - ">= 5.0.0.beta.2"
+
+related:
+  url:
+    - https://snyk.io/vuln/SNYK-RUBY-HAML-20362