Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2023-29827 — CRITICAL severity vulnerability | Release Alert

CVE-2023-29827

9.8

CRITICALCVSS v3

Published

May 4, 2023

Affected

7 projects

Assigned by

MITRE

Severity scale

010

Description

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.

NPMEmbedded JavaScript templates

= 3.1.9, >= 3.1.9NVD

GitHubEmbedded JavaScript templates -- http://ejs.co

= 3.1.9, >= 3.1.9NVD

NPM

More on this CVE

NVD↗GitHub Advisory↗

TypeScript definitions for ejs

= 3.1.9, >= 3.1.9NVD

@transformation/ejs

NPMWriting pipeline to files with EJS

= 3.1.9, >= 3.1.9NVD

@nightwatch/ejs

NPMEmbedded JavaScript templates

= 3.1.9, >= 3.1.9NVD

GitHuba koa view render middleware, support all feature of ejs

= 3.1.9, >= 3.1.9NVD

RubyGemsCompile and evaluate EJS (Embedded JavaScript) templates from Ruby.

= 3.1.9, >= 3.1.9NVD