Skip to main content
cve.nowby Sazabi
← npm
npmPackage

ejs

5 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 medium
Registry
npm

Advisories 5

  • CVE-2024-33883Medium 4.0

    The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

    Affected: fixed in 3.1.10.

  • The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view…

    Affected: fixed in 3.1.7.

  • nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

    Affected: fixed in 2.5.5.

  • nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()

    Affected: fixed in 2.5.5.

  • nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

    Affected: fixed in 2.5.5.