{"action":"Upgrade ejs to 3.1.7 or later.","affected":[{"fixed":"3.1.7","introduced":"0"}],"component":"ejs","cve_ids":["CVE-2022-29078"],"ecosystem":"npm","epss":0.32808,"exploited":false,"fixed_versions":["3.1.7"],"ghsa_id":"GHSA-phwq-j96m-2c2q","id":"tcs_01M5KG3R25SK3NGB73EAWDXE2A","modified_at":"2023-11-08T04:09:07.883219Z","published_at":"2022-04-26T00:00:40Z","references":["https://osv.dev/vulnerability/GHSA-phwq-j96m-2c2q","https://nvd.nist.gov/vuln/detail/CVE-2022-29078","https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf","https://eslam.io/posts/ejs-server-side-template-injection-rce","https://github.com/mde/ejs","https://github.com/mde/ejs/releases","https://security.netapp.com/advisory/ntap-20220804-0001"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-phwq-j96m-2c2q","url":"https://osv.dev/vulnerability/GHSA-phwq-j96m-2c2q"}],"summary":"ejs template injection vulnerability"}