Read the docs
TI-2017-14544 Aliases CVE-2017-1000228GHSA-3w5v-p54c-f74x

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak…

Priority MEDIUM 51CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

Why it matters now

EPSS 0.0638 93rd percentileScored 2026-11-07
Fix Fixed ejs (npm): 2.5.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ejs (npm)before 2.5.52.5.5Patch availableGHSA-3w5v-p54c-f74x
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ejs (npm) Vendor— Affected before 2.5.5 Fixed in 2.5.5 Patch available GHSA-3w5v-p54c-f74x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ejs:ejs:*:*:*:*:*:*:*:*before 2.5.3VulnerableEjs
  • cpe:2.3:a:ejs:ejs:*:*:*:*:*:*:*:* Versions before 2.5.3 Vulnerable ·Ejs

Remediation

  • Fix · GHSA-3w5v-p54c-f74x ejs (npm) Fixed in 2.5.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1000228
  2. 2026-10-03 Alias added: GHSA-3w5v-p54c-f74x

References

Advisory 2

Other 1

  • TI-2023-14035 ejs v3.1.9 is vulnerable to server-side template injection. CVSS 3.1CRITICAL 9.8
  • TI-2022-11633 The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side… CVSS 3.1CRITICAL 9.8
  • TI-2017-14510 nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak… CVSS 3.0HIGH 7.5
  • TI-2017-14509 nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences