| Name | CVE-2023-29827 |
| Description | ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| node-ejs (PTS) | buster | 2.5.7-1+deb10u1 | vulnerable |
| bullseye | 2.5.7-3+deb11u1 | vulnerable |
| bookworm | 3.1.8+~3.1.1-2 | vulnerable |
| sid, trixie | 3.1.9+~3.1.5-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| node-ejs | source | (unstable) | (unfixed) | unimportant | | |
Notes
https://github.com/mde/ejs/issues/720
Not considered a security issue by upstream, requires to never give unfiltered
input to the EJS's render function.