Skip to content
OpenAdvisories

Package · npm

ejs

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2022-29078 Public exploit Scanner template EPSS 33%

    ejs template injection vulnerability

    The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS …

    node-ejs ejs node-ejs Debian Ubuntu npm
  • Critical 9.8
    CVE-2017-1000228

    ejs is vulnerable to remote code execution due to weak input validation

    nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

    node-ejs ejs Debian npm