CVE-2022-29078

🗓️ 25 Apr 2022 14:13:32Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 310 Views🌐 WEB

The ejs package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName

Reporter	Title	Published	Views	Family All 38
GithubExploit	Exploit for Code Injection in Ejs	5 Nov 202406:15	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	7 Jan 202522:07	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	20 Jul 202210:10	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	12 Apr 202613:24	–	githubexploit
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to code injection due to CVE-2022-29078	31 May 202222:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for May 2022	20 Jun 202213:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm
IBM Security Bulletins	Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to ejs [CVE-2022-29078]	11 Aug 202210:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to arbitrary code execution due to Node.js ejs module (CVE-2022-29078)	11 Jul 202208:58	–	ibm

NVD

Node

ejs ejsMatch3.1.6node.js

Source	Link
security	www.security.netapp.com/advisory/ntap-20220804-0001/
github	www.github.com/mde/ejs/releases
eslam	www.eslam.io/posts/ejs-server-side-template-injection-rce/

Parameter	Position	Path	Description	CWE
settings[view options][outputFunctionName]	query param	/page	Server-Side Template Injection in EJS via settings[view options][outputFunctionName] that overwrites outputFunctionName and allows execution of arbitrary OS commands upon template compilation.	CWE-94
id	query param	/page	Server-Side Template Injection in EJS via settings[view options][outputFunctionName] that overwrites outputFunctionName and allows execution of arbitrary OS commands upon template compilation.	CWE-94

17 Jun 2026 04:39Current

9.5High risk

Vulners AI Score9.5

CVSS 27.5

CVSS 3.19.8

EPSS0.32386