GitHub Advisoryadvisory · npm

GHSA-ghr5-ch3p-vcr6 ejs lacks certain pollution protection

MEDIUM Published 2024-04-28 Modified 2024-08-02 Official page ↗

Aliases: CVE-2024-33883
Ecosystem: npm
Packages: ejs
Severity: Moderate
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-1321, CWE-693
Reviewed: 2024-05-01

Affected packages

• npm ejs: < 3.1.10 → fixed in 3.1.10

Description

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Related

Alias · CVE (1)

CVE-2024-33883 The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection. vulnerability

Weakness · CWE (2)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
CWE-693 Protection Mechanism Failure weakness

References