En resumen
- CVE-2022-29078 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a ejs (ejs), ejs.
- Probabilidad de explotación en los próximos 30 días (EPSS): 32.8%, mayor que el 98.4% de las vulnerabilidades.
- Solución: actualizar a 3.1.7 o posterior.
| Package | Affected versions | Patched versions |
|---|
| ejs | = 3.1.6
| No fix yet |
| ejs npm | < 3.1.7
| 3.1.7
|
Description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
NVD description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free