MediumGHSA-ghr5-ch3p-vcr6CVE-2024-33883

ejs lacks certain pollution protection

Published 28 Apr 2024 · Updated 10 Sept 2026

Affected package

ejsnpm

Affected: <3.1.10
Fixed in: 3.1.10

Update to the fixed version for your release line, for example:npm install ejs@3.1.10

Details

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Is GHSA-ghr5-ch3p-vcr6 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected ejs, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2024-33883
Linkgithub.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5
Packagegithub.com/mde/ejs
Linkgithub.com/mde/ejs/compare/v3.1.9...v3.1.10
Linksecurity.netapp.com/advisory/ntap-20240605-0003

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.