The vulnerability of the outputFunctionName function in the Node.js web application framework allows a attacker to execute arbitrary commands.

🗓️ 13 Jul 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 10 Views

Vulnerability in outputFunctionName of a Node.js web framework allows remote command execution due to improper elimination of special elements in output data.

Reporter	Title	Published	Views	Family All 42
GithubExploit	Exploit for Code Injection in Ejs	13 Jul 202616:52	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	5 Nov 202406:15	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	11 Jul 202612:59	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	7 Jan 202522:07	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	20 Jul 202210:10	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	12 Apr 202613:24	–	githubexploit
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to code injection due to CVE-2022-29078	31 May 202222:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for May 2022	20 Jun 202213:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm

Source	Link
eslam	www.eslam.io/posts/ejs-server-side-template-injection-rce/
github	www.github.com/mde/ejs/releases
github	www.github.com/mde/ejs/releases/tag/v3.1.7
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
web	www.web.nvd.nist.gov/view/vuln/detail

23 Jul 2026 00:00Current

7High risk

Vulners AI Score7

CVSS 39.8

CVSS 210

EPSS0.32808

outputFunctionName web framework vulnerability remote command execution special elements handling output data vulnerability