169 matches found
CVE-2026-47727 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
CVE-2026-47727 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
CVE-2026-47727 Trilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
EUVD-2026-67238
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...
CVE-2026-47727
Trilium (open-source hierarchical note-taking app) versions prior to 0.104.0 are vulnerable to remote code execution via a bypass of its default-on "Safe import" filter. The shareTemplate relation is omitted from the built-in list of dangerous attributes, so it is not disabled on import. An attac...
PT-2026-82679
Name of the Vulnerable Software and Affected Versions Trilium versions prior to 0.104.0 Description The Safe import filter fails to neutralize the shareTemplate relation because it is not marked as dangerous. This allows an attacker to provide a malicious import archive that plants a server-side...
CLSA-2026-1780534260 TuxCare security update for ejs (1 CVE)
TuxCare rebuilt ejs to address 1 CVE. Fixed in 3.1.9-tuxcare.1...
CLSA-2026-1774570931 TuxCare security update for ejs (2 CVEs)
TuxCare rebuilt ejs to address 2 CVEs. Fixed in 2.7.4-tuxcare.1...
CLSA-2026-1774570929 TuxCare security update for ejs (5 CVEs)
TuxCare rebuilt ejs to address 5 CVEs. Fixed in 1.0.0-tuxcare.1...
CVE-2026-54661: Improper Neutralization of Special Elements in Output Used by a Downstream Component
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
ROOT-APP-NPM-CVE-2022-29078 CVE-2022-29078 in @rootio/ejs - Patched by Root
Root has patched CVE-2022-29078 in the @rootio/ejs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-33883 CVE-2024-33883 in @rootio/ejs - Patched by Root
Root has patched CVE-2024-33883 in the @rootio/ejs package for Root:npm. Multiple fixed versions available...
Exploit for Code Injection in Ejs
Seal Security — JavaScript npm Example A minimal, intention...
MGASA-2026-0234 Updated yt-dlp packages fix security vulnerabilities
CVE-2026-50019 If curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. CVE-2026-50023 A vulnerability exists in yt-dlp that allows a remote attacker to write...
CVE-2026-47376
CVE-2026-47376 (NocoDB) describes a reflected XSS on the password-reset flow. Before 2026.04.1, the token from the password-reset URL was directly embedded into a JavaScript string in a server-rendered EJS template, which does not escape single quotes or backslashes. This allowed an attacker-cont...
CVE-2026-47376: Improper Neutralization of Input During Web Page Generation
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or...
NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Summary The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and...
CVE-2026-41951
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI...
CVE-2026-41951: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI...