The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.