Embedded JavaScript templates vulnerable to pollution
CVE-2024-33883

Currently unrated

Key Information:

Vendor: ejs
Vendor: CVE Published:; 28 April 2024

🔔 Create ejs Vulnerability Alert

Badges

👾 Exploit Exists

What is CVE-2024-33883?

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

References

https://github.com/mde/ejs/commit/e469741dca7df2eb400199e...

https://github.com/mde/ejs/compare/v3.1.9...v3.1.10

Download the Critical Vulnerability Management Cheat Sheet

Timeline

🟡
Public PoC available
Jun 26, 2024
👾
Exploit known to exist
Jun 26, 2024
Vulnerability published
Apr 28, 2024
Vulnerability Reserved
Apr 28, 2024

.