Description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-ejs | 3.1.7-1 | — |
| Debian 13 | node-ejs | 3.1.7-1 | — |
| Debian 12 | node-ejs | 3.1.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | node-ejs | No fix yet | — |
| Ubuntu 20.04 LTS | node-ejs | No fix yet | — |
| Ubuntu 18.04 LTS | node-ejs | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 9 repositories
-
miko550/CVE-2022-29078 ★ 8 · Jul 20, 2022
vuln ejs 3.1.6 docker
-
l0n3m4n/CVE-2022-29078 ★ 3 · Nov 5, 2024
Serverside Template Injection (SSTI) RCE - THM challenge "whiterose"
-
taka3636/CVE-2022-29078 ★ 0 · Jul 11, 2026
-
test-avm-714877d2df585126/C-test-2 ★ 0 · Jun 24, 2026
Dependabot security automerge test - ejs CVE-2022-29078
-
test-avm-714877d2df585126/vuln-ejs-critical ★ 0 · Jun 24, 2026
npm repo with ejs CVE-2022-29078 (CVSS 9.8, EPSS 32%) for Dependabot automerge testing
-
amusedx/CVE-2022-29078 ★ 0 · Apr 12, 2026
-
AlonNavon/npm-demo ★ 0 · Feb 15, 2026
Browser demo: EJS template injection (CVE-2022-29078) with Seal Security remediation
-
chuckdu21/CVE-2022-29078 ★ 0 · Jan 7, 2025
PoC for CVE-2022-29078
-
shurochka1396/expluatation_CVE-2022-29078 ★ 0 · Jul 26, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Node.js Embedded JavaScript 3.1.6 - Template Injection http/cves/2022/CVE-2022-29078.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ejs | < 3.1.7 | 3.1.7 | GHSA-phwq-j96m-2c2q |
Advisories 1
- WID-SEC-2022-0909 IBM DB2: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Aug 9, 2026