← Vulnerability feed

Vulnerability record · CVE-2022-29078 · published 25 April 2022

CVE-2022-29078: Ejs code injection vulnerability

Ejs · Ejs

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

9.8 CVSS 3.1 Critical EPSS 33% · top 1.7% CWE-94 · Code injection
9.8CVSS 3.1 base score, v2 7.5
33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://eslam.io/posts/ejs-server-side-template-injection-rce/ ExploitPatchThird Party Advisory
https://github.com/mde/ejs/releases Release NotesThird Party Advisory
https://security.netapp.com/advisory/ntap-20220804-0001/ Third Party Advisory
https://eslam.io/posts/ejs-server-side-template-injection-rce/ ExploitPatchThird Party Advisory
https://github.com/mde/ejs/releases Release NotesThird Party Advisory
https://security.netapp.com/advisory/ntap-20220804-0001/ Third Party Advisory

Track CVE-2022-29078 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-29827Ejs injection vulnerabilityejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the config…EPSS 5.6%9.8CVE-2017-1000228Ejs improper input validation vulnerabilitynodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() functionEPSS 6.3%7.5CVE-2017-1000189Ejs improper input validation vulnerabilitynodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()EPSS 2.3%6.1CVE-2017-1000188Ejs cross-site scripting vulnerabilitynodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injectionEPSS 1.2%8.8CVE-2026-65660Microsoft sharepoint server code injection vulnerabilityImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.KEVEPSS 2.1%9.8CVE-2026-60004Gitea diffpatch API code injection enables remote code executionGitea before 1.27.1 allows remote code execution through the diffpatch API by way of Git hook installation. The flaw is a code injection issue (CWE-9…KEVEPSS 24%analysed9.5CVE-2026-72530TrueConf Server sandbox breakout via crafted script code injectionTrueConf Server versions 5.3.X through 5.3.9, 5.4.X through 5.4.9, 5.5.X through 5.5.5 and earlier allow a remote unauthenticated attacker to break o…KEVEPSS 1.7%analysed9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed

Source: NIST National Vulnerability Database (record CVE-2022-29078), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.