[VULN] Security Alert for ejs #38

Alert IDs:

• 05d0c8d8-1dfe-46a8-9d44-cff6bd7000c1
• 08f7142a-733e-4cb9-8670-98d2f95e9b45
• 1856012f-35e4-4885-8024-0e9f29c65a34
• 90ae2e91-82b7-44f0-96d4-c011920ed529
• e1e821f3-ddea-4ced-b155-d5194dd194eb

Vulnerabilities in ejs

Release: 0.0.1

Total Vulnerabilities: 5

1. CVE-2017-1000189

Severity: HIGH (Score: 7.5)

Description:
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-1000189

Alert ID: 05d0c8d8-1dfe-46a8-9d44-cff6bd7000c1

2. CVE-2017-1000188

Severity: MEDIUM (Score: 6.1)

Description:
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-1000188

Alert ID: 08f7142a-733e-4cb9-8670-98d2f95e9b45

3. CVE-2024-33883

Severity: MEDIUM (Score: 4.0)

Description:
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-33883

Alert ID: 1856012f-35e4-4885-8024-0e9f29c65a34

4. CVE-2017-1000228

Severity: CRITICAL (Score: 9.8)

Description:
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-1000228

Alert ID: 90ae2e91-82b7-44f0-96d4-c011920ed529

5. CVE-2022-29078

Severity: CRITICAL (Score: 9.8)

Description:
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-29078

Alert ID: e1e821f3-ddea-4ced-b155-d5194dd194eb