Filtered by vendor Ejs
Subscribe
Search
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-29078 | 1 Ejs | 1 Ejs | 2023-08-08 | 7.5 HIGH | 9.8 CRITICAL |
| The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation). | |||||
| CVE-2017-1000228 | 1 Ejs | 1 Ejs | 2017-11-30 | 10.0 HIGH | 9.8 CRITICAL |
| nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function | |||||