Skip to content
OpenAdvisories

Package · npm

ejs

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 4.0
    CVE-2024-33883 Public exploit

    ejs lacks certain pollution protection

    The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

    node-ejs ejs node-ejs Debian Ubuntu npm
  • Critical 9.8
    CVE-2022-29078 Public exploit EPSS 33%

    ejs template injection vulnerability

    The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS …

    node-ejs ejs node-ejs Debian Ubuntu npm
  • High 7.5
    CVE-2017-1000189

    ejs vulnerable to DoS due to weak input validation

    nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()

    node-ejs ejs Debian npm
  • Critical 9.8
    CVE-2017-1000228

    ejs is vulnerable to remote code execution due to weak input validation

    nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

    node-ejs ejs Debian npm
  • Medium 6.1
    CVE-2017-1000188

    mde ejs vulnerable to XSS

    nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

    node-ejs ejs Debian npm