mde ejs vulnerable to XSS

Description

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

Recommendation

Update the ejs package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.5.5
• Patched version(s): 2.5.5

References

• GHSA-hwcf-pp87-7x6p
• web.archive.org
• CVE-2017-1000188
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Denial of Service in jquery - CVE-2016-10707
• gifplayer XSS vulnerability - CVE-2025-31128
• ejs lacks certain pollution protection - CVE-2024-33883
• Prototype pollution in gsap - CVE-2020-28478

Tags:

npm

ejs