Uh oh!
There was an error while loading. Please reload this page.
Update dependency ejs to v3.1.7 [SECURITY] - #589
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
January 4, 2024 12:01
02a3424 to
a0650d8ComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
February 24, 2024 04:28
a0650d8 to
2ddba73ComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
May 1, 2024 21:51
2ddba73 to
70c076aComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
August 6, 2024 07:28
70c076a to
9bd6b25CompareCode Climate has analyzed commit 9bd6b25 and detected 0 issues on this pull request. View more on Code Climate. |
renovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
2 times, most recently
from
August 15, 2025 04:00
400ae3b to
4b484daComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
October 16, 2025 00:55
4b484da to
b802574ComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
March 5, 2026 20:58
b802574 to
60914feComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
2 times, most recently
from
March 30, 2026 17:45
60914fe to
0bf23f9ComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
2 times, most recently
from
April 27, 2026 23:39
0bf23f9 to
0460ce5ComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
May 28, 2026 17:37
0460ce5 to
83dba26ComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
July 12, 2026 17:16
83dba26 to
e903bc6ComparerenovateBotforce-pushed
the
renovate/npm-ejs-vulnerability
branch
from
July 30, 2026 17:48
e903bc6 to
eff49bdCompare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.1.6→3.1.7ejs template injection vulnerability
CVE-2022-29078 / GHSA-phwq-j96m-2c2q
More information
Details
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
mde/ejs (ejs)
v3.1.7Compare Source
Version 3.1.7
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.