Vulnerability in N/a
CVE-2022-29078
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option w…
EPSS: 0.935 (99.8th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- github.com/mde/ejs/releases (x_refsource_MISC)
- eslam.io/posts/ejs-server-side-template-injection-rce/ (x_refsource_MISC)
- security.netapp.com/advisory/ntap-20220804-0001/ (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2022-29078?
- CVE-2022-29078 is a vulnerability in N/a. Published 2022-04-25.
- Is CVE-2022-29078 known to be exploited?
- 52 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.