CVE-2017-1000228: Remote Code Execution in ejs
Summary
CVE-2017-1000228: ejs is vulnerable to remote code execution due to weak input validation. Affects ejs versions < 2.5.5. Fixed in 2.5.5. How to fix ↓
Also tracked for
- node-ejs · Debian:11
The same CVE-2017-1000228 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ejs is an open-source JavaScript templating engine that allows developers to embed JavaScript code within HTML templates. It is commonly used in Node.js applications to generate dynamic web pages. However, versions older than 2.5.3 of ejs are vulnerable to remote code execution due to weak input validation in the ejs.renderFile() function.
Vulnerability Detail
The vulnerability in ejs arises from inadequate input validation in the ejs.renderFile() function. An attacker can exploit this weakness by injecting malicious code into the template, which will be executed when the template is rendered. This can lead to arbitrary code execution on the server, potentially compromising the entire application and its underlying infrastructure. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 7.0.2 as of 23 Oct 2026
npm install ejs@7.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.5
This is the first release that contains the fix.
npm install ejs@2.5.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of ejs is not feasible, a temporary workaround is to sanitize user input before passing it to the ejs.renderFile() function. This can be done by using a trusted input validation library or implementing custom input validation logic. It is crucial to ensure that all user-supplied data is properly validated and sanitized to prevent code injection attacks.
Conclusion
In conclusion, ejs versions older than 2.5.3 are vulnerable to remote code execution due to weak input validation. It is crucial to upgrade to the latest version of ejs or apply proper input validation to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ejs →
FAQ
ejs is a JavaScript templating engine that allows developers to generate dynamic web pages by embedding JavaScript code within HTML templates.
This vulnerability allows an attacker to execute arbitrary code on the server, potentially compromising the entire application and its underlying infrastructure.
To fix this vulnerability, you should upgrade to ejs version 2.5.5 or later. Update your package.json file and run the package manager to install the latest version.
If upgrading is not possible, you can sanitize user input before passing it to the ejs.renderFile() function. Use a trusted input validation library or implement custom input validation logic.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for ejs.
