CVE-2022-29078

🗓️ 25 Apr 2022 14:13:32Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 364 Views🌐 WEB

The ejs package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName

Reporter	Title	Published	Views	Family All 52
GithubExploit	Exploit for Code Injection in Ejs	13 Jul 202616:52	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	5 Nov 202406:15	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	11 Jul 202612:59	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	7 Jan 202522:07	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	20 Jul 202210:10	–	githubexploit
GithubExploit	Exploit for Code Injection in Ejs	12 Apr 202613:24	–	githubexploit
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to code injection due to CVE-2022-29078	31 May 202222:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for May 2022	20 Jun 202213:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm

NVD

Node

ejs ejsMatch3.1.6node.js

Source	Link
security	www.security.netapp.com/advisory/ntap-20220804-0001/
github	www.github.com/mde/ejs/releases
eslam	www.eslam.io/posts/ejs-server-side-template-injection-rce/

Parameter	Position	Path	Description	CWE
settings[view options][outputFunctionName]	nested	/page	Server-Side Template Injection via EJS 3.1.6 allowing overwriting outputFunctionName with an OS command through the nested query parameter settings[view options][outputFunctionName].	CWE-94

17 Jun 2026 04:39Current

9.5Critical risk

Vulners AI Score9.5

CVSS 27.5

CVSS 3.19.8

EPSS0.32808