Update dependency ejs to v3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ejs	^2.5.7 → ^3.1.10

---

ejs template injection vulnerability

CVE-2022-29078 / GHSA-phwq-j96m-2c2q

More information

Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-29078
• https://eslam.io/posts/ejs-server-side-template-injection-rce/
• https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf
• https://github.com/mde/ejs/releases
• https://security.netapp.com/advisory/ntap-20220804-0001/
• https://github.com/advisories/GHSA-phwq-j96m-2c2q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ejs lacks certain pollution protection

CVE-2024-33883 / GHSA-ghr5-ch3p-vcr6

More information

Details

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-33883
• https://github.com/mde/ejs/commit/e469741dca7df2eb400199e1cdb74621e3f89aa5
• https://github.com/mde/ejs/compare/v3.1.9...v3.1.10
• https://security.netapp.com/advisory/ntap-20240605-0003
• https://github.com/advisories/GHSA-ghr5-ch3p-vcr6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mde/ejs (ejs)

v3.1.10

Compare Source

Version 3.1.10

v3.1.9

Compare Source

Version 3.1.9

v3.1.8

Compare Source

Version 3.1.8

v3.1.7

Compare Source

Version 3.1.7

v3.1.6

Compare Source

Version 3.1.6

v3.1.5

Version 3.1.5

v3.1.3

Compare Source

v3.1.2

Compare Source

v3.0.2

Compare Source

v3.0.1

Compare Source

v2.7.4

Compare Source

Bug fixes

• Fixed Node 4 support, which broke in v2.7.3 (5e42d6c, @​mde)

v2.7.3

Compare Source

Bug fixes

• Made the post-install message more discreet by following the example of opencollective-postinstall (228d8e4, @​mde)

v2.7.2

Compare Source

Features

• Added support for destructuring locals (#​452, @​ExE-Boss)
• Added support for disabling legacy include directives (#​458, #​459, @​ExE-Boss)
• Compiled functions are now shown in the debugger (#​456, @​S2-)
• function.name is now set to the file base name in environments that support this (#​466, @​ExE-Boss)

Bug Fixes

• The error message when async != true now correctly mention the existence of the async option (#​460, @​ExE-Boss)
• Improved performance of HTML output generation (#​470, @​nwoltman)

v2.7.1

Compare Source

Deprecated:

• Added deprecation notice for use of require.extensions (@​mde)

v2.6.2

Compare Source

• Correctly pass custom escape function to includes (@​alecgibson)
  • Fixes for rmWhitespace (@​nwoltman)
  • Examples for client-side EJS compiled with Express middleware (@​mjgs)
  • Make Template constructor public (@​ThisNameWasTaken)
  • Added remove function to cache (@​S2-)
  • Recognize both 'Nix and Windows absolute paths (@​mde)

v2.6.1

Compare Source

v2.5.9

Compare Source

v2.5.8

Compare Source

• Add filename to error when include file cannot be found (@​Leon)
• Node v9 in CI (@​Thomas)

• Fixed special case for Express caching (@​mde)

• Added Promise/async-await support to renderFile (@​mde)
• Added notes on IDE support to README (@​Betanu701)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.