CVE-2017-1000228 - nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

CRITICAL

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

Published Nov 17, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 6.33%

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

Ecosystem	Package	Introduced	Fixed
npm	ejs	0	2.5.5

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

Link	Providers	Tags
http://www.securityfocus.com/bid/101897		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-3w5v-p54c-f74x		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-1000228
https://snyk.io/vuln/npm:ejs:20161128		x_refsource_MISCExploitTechnical DescriptionThird Party Advisory
https://web.archive.org/web/20171123041219/http://www.securityfocus.com/bid/101897