mde ejs vulnerable to XSS

Description

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

Recommendation

Update the ejs package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.5.5
• Patched version(s): 2.5.5

References

• GHSA-hwcf-pp87-7x6p
• web.archive.org
• CVE-2017-1000188
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Marked vulnerable to XSS from data URIs - CVE-2017-1000427
• ejs is vulnerable to remote code execution due to weak input validation - CVE-2017-1000228
• ejs vulnerable to DoS due to weak input validation - CVE-2017-1000189
• rendertron XSS vulnerability - CVE-2017-18352

Tags:

npm

ejs