GHSA-phwq-j96m-2c2q

ejs template injection vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-29078

Packages

Ecosystem	Package	Affected	Fixed in
npm	ejs	< 3.1.7	3.1.7

Details

As written in the advisory (Markdown source, shown as plain text).

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-29078 advisory
https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf web
https://eslam.io/posts/ejs-server-side-template-injection-rce web
https://github.com/mde/ejs package
https://github.com/mde/ejs/releases web
https://security.netapp.com/advisory/ntap-20220804-0001 web