En bref
- CVE-2022-29078 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant ejs (ejs), ejs.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 32.8%, plus élevée que 98.4% des vulnérabilités.
- Correctif : mettre à jour vers 3.1.7 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| ejs | = 3.1.6
| No fix yet |
| ejs npm | < 3.1.7
| 3.1.7
|
Description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
NVD description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free