[VULN] Security Alert for ejs #33

Alert IDs:

• 40325ccc-de1f-4443-b8e0-58de03cc9a0f
• 983c6db7-cf40-4e95-8a59-d3f601b888f9
• 99dc25d2-6fb7-4e74-bc13-6277075a5d17
• ac5ddc1a-200e-4773-9d25-6c04a6483537
• eca18232-06ad-4e6f-b68c-c9c4b4576ca6

Vulnerabilities in ejs

Release: Test release

Total Vulnerabilities: 5

1. CVE-2017-1000189

Severity: HIGH (Score: 7.5)

Description:
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-1000189

Alert ID: 40325ccc-de1f-4443-b8e0-58de03cc9a0f

2. CVE-2024-33883

Severity: MEDIUM (Score: 4.0)

Description:
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-33883

Alert ID: 983c6db7-cf40-4e95-8a59-d3f601b888f9

3. CVE-2022-29078

Severity: CRITICAL (Score: 9.8)

Description:
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-29078

Alert ID: 99dc25d2-6fb7-4e74-bc13-6277075a5d17

4. CVE-2017-1000188

Severity: MEDIUM (Score: 6.1)

Description:
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-1000188

Alert ID: ac5ddc1a-200e-4773-9d25-6c04a6483537

5. CVE-2017-1000228

Severity: CRITICAL (Score: 9.8)

Description:
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-1000228

Alert ID: eca18232-06ad-4e6f-b68c-c9c4b4576ca6