Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
Recommended action: Upgrade to 3.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Recommended action: Upgrade to 3.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in `ejs.renderFile()` function
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
Recommended action: Upgrade to 2.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.