CVE-2024-33883: ejs lacks certain pollution protection

April 28, 2024 (updated May 1, 2024)

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

References

github.com/advisories/GHSA-ghr5-ch3p-vcr6
github.com/mde/ejs
github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5
github.com/mde/ejs/compare/v3.1.9...v3.1.10
nvd.nist.gov/vuln/detail/CVE-2024-33883

Code Behaviors & Features

Detect and mitigate CVE-2024-33883 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →