CyberSecBulletin

Ejs vulnerabilities

We track 2 vulnerabilities in Ejs products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 4, 2023.

2vulnerabilities
2critical
0high
0exploited
9.8average CVSS score

Latest Ejs vulnerabilities

  • 9.8 Critical severity

    Ejs: Improper Neutralization of Special Elements in Output Used by a Downstream Component

    CVE-2023-29827EjsEPSS 5.55%

    ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render funct

  • 9.8 Critical severity

    Ejs: Improper Control of Generation of Code

    CVE-2022-29078EjsEPSS 32.8%

    The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS c