CVE-2023-29827: Ejs

Critical severity, CVSS 9.8. EPSS: 5.6% chance of exploitation in the next 30 days.

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter. NOTE: this is disputed by the vendor because the render function is not intended to be used with untrusted input.

Affected products

• Ejs Ejs: from 3.1.9

Published 2023-05-04. Last modified 2026-06-17.