UBUNTU-CVE-2023-29827
- Source
- https://ubuntu.com/security/CVE-2023-29827
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-29827.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-29827
- Withdrawn
- 2025-06-23T15:56:50Z
- Published
- 2023-05-04T14:15:00Z
- Modified
- 2023-05-04T14:15:00Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
* DISPUTED * ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.
- References
Affected packages
Ubuntu:Pro:18.04:LTS / node-ejs
Package
- Name
- node-ejs
- Purl
- pkg:deb/ubuntu/node-ejs
Ubuntu:20.04:LTS / node-ejs
Package
- Name
- node-ejs
- Purl
- pkg:deb/ubuntu/node-ejs
Ubuntu:22.04:LTS / node-ejs
Package
- Name
- node-ejs
- Purl
- pkg:deb/ubuntu/node-ejs