Description
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
Recommendation
Update the ejs package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.1.10
- Patched version(s): 3.1.10
References
Related Issues
- Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
- njwt Prototype Pollution vulnerability - CVE-2024-34273
- jsonic was discovered to contain a prototype pollution via the function empty. - CVE-2024-38993
- @75lb/deep-merge Prototype Pollution vulnerability - CVE-2024-38986
You might also like:
- Tags:
- npm
- ejs
Anything's wrong? Let us know Last updated on August 02, 2024