Kurz gesagt
- CVE-2022-29078 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in ejs (ejs), ejs.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 32.8%, höher als bei 98.4% aller Schwachstellen.
- Abhilfe: auf 3.1.7 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| ejs | = 3.1.6
| No fix yet |
| ejs npm | < 3.1.7
| 3.1.7
|
Description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
NVD description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free