The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side…
Priority HIGH 67CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Why it matters now
EPSS 0.32808 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial ejs (npm): 3.1.7Red Hat: 9 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | ejs (npm) | before 3.1.7 | 3.1.7 | Patch available | GHSA-phwq-j96m-2c2q |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- ejs (npm) Vendor— Affected before 3.1.7 Fixed in 3.1.7 Patch available GHSA-phwq-j96m-2c2q
Remediation
- Fix · GHSA-phwq-j96m-2c2q ejs (npm) Fixed in 3.1.7 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Integration Data Virtualisation Operator | Affected | No fix planned: Out of support scope |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
Not affected: 5 products
- OpenShift Service Mesh 2.1
- Red Hat A-MQ Online
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 1
- Red Hat OpenShift distributed tracing 2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-29078
- 2026-10-03 Alias added: GHSA-phwq-j96m-2c2q
References
Advisory 3
More Ejs vulnerabilities
- TI-2023-14035 ejs v3.1.9 is vulnerable to server-side template injection. CVSS 3.1CRITICAL 9.8
- TI-2017-14544 nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak… CVSS 3.0CRITICAL 9.8
- TI-2017-14510 nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak… CVSS 3.0HIGH 7.5
- TI-2017-14509 nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2022-29078 · CVE Program
- CVE-2022-29078 · NVD
- FIRST EPSS
- GHSA-phwq-j96m-2c2q · GitHub Advisory Database · CC BY 4.0
- CVE-2022-29078 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences