ejs is vulnerable to remote code execution due to weak input validation (GHSA-3w5v-p54c-f74x)
Published: 2017-11-30T23:15:19Z
Aliases: CVE-2017-1000228
Severity: CRITICAL · CWE: CWE-20

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in `ejs.renderFile()` function

Affected packages:
package: ecosystem: npm
name: ejs
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.5.5
database_specific: last_known_affected_version_range: < 2.5.3