Executive brief
ejs is a popular template engine for Node.js applications. A prototype pollution vulnerability in versions before 3.1.10 allows attackers to modify JavaScript object prototypes during template processing, potentially causing denial of service or enabling object property injection attacks. Applications using vulnerable versions could experience unexpected behavior or crashes.
Technical details
ejs lacks adequate pollution protection in its template processing logic, allowing prototype pollution attacks via CWE-1321 (improperly controlled modification of object prototype attributes). The vulnerability affects all versions before 3.1.10 and is rooted in insufficient input sanitization during template compilation. An attacker can craft malicious template data that pollutes Object.prototype or other core prototypes, affecting all subsequently created objects in the application. The attack requires the ability to control template input or data passed to ejs, with no authentication required. The fix, released in version 3.1.10, implements basic pollution protection to prevent unauthorized prototype modification. The patch is available and should be applied immediately.
Affected products
- mde ejs before 3.1.10
Timeline
- 2024-04-28: disclosed
- 2024-04-28: patched: Fix released in version 3.1.10