# CVE-2017-1000228: EJS remote code execution via weak input validation in renderFile

Source: https://junglewise.ai/threats/cve-2017-1000228-ejs-remote-code-execution-via-weak-input-validation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-11-30. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2017-1000228 · Severity: low · CVSS 3 · Published 2017-11-30

EJS is a popular JavaScript templating engine used to generate HTML markup with plain JavaScript. A vulnerability in how it processes user-provided data allows an attacker to execute arbitrary code on the server. This could lead to a complete system takeover, unauthorized access to sensitive customer data, or a total service outage.

Technologies: [ejs (npm)](https://junglewise.ai/threats/technologies/ejs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-1000228 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-1000228 being exploited in the wild.

**How severe is CVE-2017-1000228?** Low severity, with a CVSS score of 3, published 30 November 2017.

**Which products and versions are affected?** ejs (npm) SEMVER:introduced=0,fixed=2.5.5.

**Is there a fix for CVE-2017-1000228?** Yes. ejs (npm): upgrade to 2.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-1000228 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-1000228?** Check whether you run ejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ejs (npm): upgrade to 2.5.5 or later

  ```sh
  npm install ejs@2.5.5
  ```


## Technical details

EJS versions prior to 2.5.3 are vulnerable to remote code execution (RCE) via the ejs.renderFile() and ejs.render() functions. The vulnerability arises because EJS allows configuration options to be passed within the same object as the template data. If an application passes user-controlled input (such as URL query parameters) directly into these functions, an attacker can overwrite internal options like 'root'. By manipulating the 'root' option, an attacker can redirect the engine to include and execute malicious files from an arbitrary directory. This is classified as an input validation error (CWE-20) and code injection (CWE-94). The issue was mitigated in version 2.5.3 by blacklisting sensitive options from being passed via the data object.

## Affected products

- mde ejs < 2.5.3

## Identifiers

- CVE-2017-1000228
- GHSA-3w5v-p54c-f74x

## Timeline

- 2016-11-27: disclosed: Issue reported to package owner by Snyk
- 2016-11-28: patched: Version 2.5.3 released to fix the vulnerability
- 2017-11-16: advisory: NVD published CVE-2017-1000228

## References

- [https://snyk.io/vuln/npm:ejs:20161128](https://snyk.io/vuln/npm:ejs:20161128)
- [https://web.archive.org/web/20171123041219/http://www.securityfocus.com/bid/101897](https://web.archive.org/web/20171123041219/http://www.securityfocus.com/bid/101897)

## Related threats

- [ejs prototype pollution in template processing](https://junglewise.ai/threats/cve-2024-33883-ejs-prototype-pollution-in-template-processing)
- [ejs template injection via outputFunctionName](https://junglewise.ai/threats/cve-2022-29078-ejs-template-injection-via-outputfunctionname)
- [ejs denial of service via weak input validation](https://junglewise.ai/threats/cve-2017-1000189-ejs-denial-of-service-via-weak-input-validation)
- [mde ejs XSS in renderFile](https://junglewise.ai/threats/cve-2017-1000188-mde-ejs-xss-in-renderfile)