~ / search / GHSA-hwcf-pp87-7x6p

GHSA-hwcf-pp87-7x6p

mde ejs vulnerable to XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-1000188

Packages

EcosystemPackageAffectedFixed in
npm ejs < 2.5.5 2.5.5

Details

As written in the advisory (Markdown source, shown as plain text).

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the `ejs.renderFile()` resulting in code injection

References

External links from the advisory. They lead to third-party sites.