CVE-2022-29078: ejs template injection vulnerability
Summary
CVE-2022-29078: ejs template injection vulnerability. Affects ejs versions < 3.1.7. Fixed in 3.1.7. How to fix ↓
Also tracked for
- node-ejs · Debian:11
The same CVE-2022-29078 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ejs (Embedded JavaScript templates) package is a popular templating engine for Node.js applications. It allows developers to embed JavaScript code within HTML templates, making it easier to generate dynamic content. The package is widely used in web development projects and has a large user base. However, a vulnerability has been discovered in version 3.1.6 of the ejs package that allows for server-side template injection.
Vulnerability Detail
The ejs package version 3.1.6 for Node.js is vulnerable to server-side template injection. This vulnerability occurs when the 'settings[view options][outputFunctionName]' option is parsed as an internal option and overwrites the 'outputFunctionName' option with an arbitrary OS command. When the template is compiled, the injected command is executed, leading to potential remote code execution. This vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 7.0.2 as of 23 Oct 2026
npm install ejs@7.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.7
This is the first release that contains the fix.
npm install ejs@3.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the 'outputFunctionName' option in the application's configuration. By removing or commenting out this option, the vulnerability can be mitigated. However, it is strongly advised to upgrade to the latest version as soon as possible.
Conclusion
The ejs template injection vulnerability in version 3.1.6 of the ejs package for Node.js poses a critical security risk, allowing for potential remote code execution. It is crucial to upgrade to version 3.1.7 or later to fix this vulnerability. In the meantime, disabling the 'outputFunctionName' option can provide temporary mitigation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ejs →
FAQ
ejs (Embedded JavaScript templates) is a popular templating engine for Node.js applications. It allows developers to embed JavaScript code within HTML templates, making it easier to generate dynamic content.
Server-side template injection is a vulnerability that allows an attacker to inject malicious code into a template engine. This can lead to remote code execution and other security risks.
The vulnerability occurs when the 'settings[view options][outputFunctionName]' option is parsed as an internal option and overwrites the 'outputFunctionName' option with an arbitrary OS command. When the template is compiled, the injected command is executed, leading to potential remote code execution.
The ejs template injection vulnerability can allow an attacker to execute arbitrary OS commands on the server, potentially leading to remote code execution. This can result in unauthorized access, data breaches, and other security compromises.
To mitigate this vulnerability, it is recommended to upgrade the ejs package to version 3.1.7 or later. If immediate upgrade is not possible, disabling the 'outputFunctionName' option in the application's configuration can provide temporary mitigation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ejs.
