CVE-2024-33883

Name of the Vulnerable Software and Affected Versions ejs versions prior to 3.1.10

Description The issue is related to the lack of certain pollution protection in the ejs package, which can be exploited to execute arbitrary code by injecting specially crafted JavaScript code. This can be done by a remote attacker through the template engine's output. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 3.1.10, upgrade the ejs package to version 3.1.10 or later to mitigate the issue. As a temporary workaround, consider restricting the use of the ejs template engine until a patch is applied. Avoid using the ejs package for rendering untrusted input until the issue is resolved.