Description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Recommendation
Update the ejs package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.1.7
- Patched version(s): 3.1.7
References
- GHSA-phwq-j96m-2c2q
- eslam.io
- security.netapp.com
- CVE-2022-29078
- CWE-74
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- PrismJS DOM Clobbering vulnerability - CVE-2024-53382
- Server-Side Request Forgery in axios - CVE-2024-39338
- ejs lacks certain pollution protection - CVE-2024-33883
- DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
- Tags:
- npm
- ejs
Anything's wrong? Let us know Last updated on January 30, 2023