# CVE-2022-29078: ejs template injection via outputFunctionName

Source: https://junglewise.ai/threats/cve-2022-29078-ejs-template-injection-via-outputfunctionname  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-04-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-29078 · Severity: low · CVSS 3.1 · Published 2022-04-26

ejs is a popular Node.js templating engine used to generate dynamic web pages and emails. A vulnerability in versions before 3.1.7 allows attackers to inject arbitrary code through the outputFunctionName option, leading to remote code execution on the server when templates are compiled. This can result in complete compromise of the affected application and underlying system.

Technologies: [ejs (npm)](https://junglewise.ai/threats/technologies/ejs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-29078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-29078 being exploited in the wild.

**How severe is CVE-2022-29078?** Low severity, with a CVSS score of 3.1, published 26 April 2022.

**Which products and versions are affected?** ejs (npm) SEMVER:introduced=0,fixed=3.1.7.

**Is there a fix for CVE-2022-29078?** Yes. ejs (npm): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-29078 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-29078?** Check whether you run ejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ejs (npm): upgrade to 3.1.7 or later

  ```sh
  npm install ejs@3.1.7
  ```


## Technical details

The vulnerability is a server-side template injection (CWE-74) in ejs versions up to 3.1.6, where the outputFunctionName setting option is not properly sanitized. An attacker can inject an arbitrary OS command by manipulating the settings[view options][outputFunctionName] parameter, which is then executed during template compilation. The attack requires network access to a vulnerable application that accepts user-controlled template options, typically through web request parameters or configuration files. An attacker can achieve remote code execution with the privileges of the Node.js process. The fix, released in version 3.1.7, sanitizes option names to prevent injection of arbitrary code.

## Affected products

- ejs ejs before 3.1.7

## Identifiers

- CVE-2022-29078
- GHSA-phwq-j96m-2c2q

## Timeline

- 2022-04-26: disclosed
- 2022-04-27: patched: Fix released in version 3.1.7
- 2022-04-25: other: NVD published CVE-2022-29078

## References

- [https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf](https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf)

## Related threats

- [ejs prototype pollution in template processing](https://junglewise.ai/threats/cve-2024-33883-ejs-prototype-pollution-in-template-processing)
- [ejs denial of service via weak input validation](https://junglewise.ai/threats/cve-2017-1000189-ejs-denial-of-service-via-weak-input-validation)
- [EJS remote code execution via weak input validation in renderFile](https://junglewise.ai/threats/cve-2017-1000228-ejs-remote-code-execution-via-weak-input-validation-in)
- [mde ejs XSS in renderFile](https://junglewise.ai/threats/cve-2017-1000188-mde-ejs-xss-in-renderfile)