| Package | Affected versions | Patched versions |
|---|---|---|
| ejs | = 3.1.6 | |
| ejs | < 3.1.7 | 3.1.7 |
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free