Em resumo
- CVE-2022-29078 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta ejs (ejs), ejs.
- Chance de exploração nos próximos 30 dias (EPSS): 32.8%, maior que 98.4% das vulnerabilidades.
- Correção: atualize para 3.1.7 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| ejs | = 3.1.6
| No fix yet |
| ejs npm | < 3.1.7
| 3.1.7
|
Description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
NVD description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free