GitHub Advisoryadvisory · npm

GHSA-3w5v-p54c-f74x ejs is vulnerable to remote code execution due to weak input validation

CRITICAL Published 2017-11-30 Modified 2023-09-08 Official page ↗

Aliases: CVE-2017-1000228
Ecosystem: npm
Packages: ejs
Severity: Critical
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20
Reviewed: 2020-06-16

Affected packages

• npm ejs: < 2.5.5 → fixed in 2.5.5

Description

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in `ejs.renderFile()` function

Related

Alias · CVE (1)

CVE-2017-1000228 nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function vulnerability

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References