Skip to content
OpenAdvisories

Package · Ubuntu

node-ejs

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 4.0
    CVE-2024-33883 Public exploit

    ejs lacks certain pollution protection

    The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

    node-ejs ejs node-ejs Debian Ubuntu npm
  • Critical 9.8
    CVE-2022-29078 Public exploit EPSS 33%

    ejs template injection vulnerability

    The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS …

    node-ejs ejs node-ejs Debian Ubuntu npm