QwikSec

Security Database

CVE

CWE

Training

CVE-2022-29078

Published: Apr 25, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/mde/ejs/releases

x_refsource_MISC

https://eslam.io/posts/ejs-server-side-template-injection-rce/

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20220804-0001/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.