ejs lacks certain pollution protection

Description

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Recommendation

Update the ejs package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.1.10
• Patched version(s): 3.1.10

References

• GHSA-ghr5-ch3p-vcr6
• security.netapp.com
• CVE-2024-33883
• CWE-1321
• CWE-693
• CAPEC-310
• OWASP 2021-A6

Related Issues

• pg-promise SQL Injection vulnerability - CVE-2025-29744
• njwt Prototype Pollution vulnerability - CVE-2024-34273
• Elliptic allows BER-encoded signatures - CVE-2024-42461
• Cross-site scripting in Survey Creator - CVE-2024-28635

Tags:

npm

ejs